jxcaxtc/cve-2025-1338Proof-of-concept exploit for CVE-2025-1338, a command injection vulnerability in NUUO Camera, with multi-threaded scanning and result output.
This repository contains a proof-of-concept exploit script for CVE-2025-1338 1.Introduction to NUUO-Camera NUUO camera is a network video recorder (NVR) produced by NUUO Company in Taiwan Province, China. It is widely used in many fields such as retail, transportation, education, government and banking.
2.Introduction to the vulnerability NUUO Camera 20250203 and earlier has an injection vulnerability, which originates from command injection in handle_config.php and debugging_center_utils_.php with parameter log. • First inclusion: February 16, 2025 • Impact version: version<=20250203 • Exploit number: CVE-2025-1338
3.Use
Example: python CVE-2025-1338.py -f url.txt -t 100
Parameter description:
-f / --file: Required. Path to the file containing the list of target URLs (one URL per line, supports both http and https).-t / --threads: Optional. Number of concurrent threads for detection. Default value is 10 (it is recommended not to exceed 200).-o / --output: Optional. Path to the output file for saving results. Default file name is "nuao_rce_results.txt" (only saves targets with vulnerabilities).-v / --version: Optional. Displays the help information for the script (same function as --help).