CVE-2025-27590 - PoC Exploit (Command Injection via Multipart Form Upload)

📌 Description

This is a Proof-of-Concept (PoC) exploit for CVE-2025-27590, a command injection vulnerability affecting web applications that process multipart file uploads without proper sanitization. The vulnerability allows remote attackers to execute arbitrary shell commands by crafting malicious form-data payloads.

---

🧠 Vulnerability Summary

• Type: Command Injection
• Vector: HTTP multipart/form-data
• Affected Parameter: cloginrc and file1 form parts
• Impact: Arbitrary shell command execution, including SSH key injection

---

🚀 Usage

python3 exploit_cve_2025_27590.py -u <TARGET_IP_OR_DOMAIN> -p -l <PATH_TO_WRITE>

python3 exploit_cve_2025_27590.py -u 172.20.221.195 -p 8888 -l /home/oxidized/.bashrc