Web Check存在远程命令执行(CVE-2025-32778)

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://cve.imfht.com/detail/CVE-2025-32778
• https://nvd.nist.gov/vuln/detail/CVE-2025-32778
• https://github.com/Lissy93/web-check/security/advisories/GHSA-5qg5-g7c2-pfx8
• https://github.com/Lissy93/web-check/pull/243
• https://access.redhat.com/security/cve/cve-2025-32778
• https://www.sentinelone.com/vulnerability-database/cve-2025-32778/
• https://cve.imfht.com/detail/CVE-2025-32778?lang=en
• https://attackerkb.com/topics/kLg9fZHRl9/cve-2025-32778

Related Vulnerabilities

• kotaemon /check_connection 命令执行漏洞（CVE-2026-69098）
• Check Point VPN IKEv1 权限绕过漏洞（CVE-2026-50751）
• PoCCVE-2025-32778: Web-Check < 2.0.1 Screenshot API - OS Command Injection
• PoCCVE-2026-50751: Check Point IKEv1 Remote-Access VPN - Certificate Authentication Bypass
• 云供应链管理系统GetTodayCheckRecord存在SQL注入漏洞
• 云供应链管理系统 GetCheckRecord 存在SQL注入漏洞
• SysAid /mdm/checkin XML 外部实体注入漏洞（CVE-2025-2775）
• PoCPowerJob /server/checkConnectivity 服务器端请求伪造漏洞（CVE-2025-14518）
• Rundeck /j_security_check 默认口令漏洞
• Pentaho /pentaho/j_spring_security_check 默认口令漏洞
• PoCcheckmk-default-login: Checkmk - Default Login
• web-check /api/screenshot 命令执行漏洞（CVE-2025-32778）
• Palo Alto Expedition /bin/configurations/parsers/Checkpoint/CHECKPOINT.php SQL 注入漏洞（CVE-2024-9465）