Description
ICTBroadcast 应用在 7.4 及以下版本中，其会话处理机制存在命令注入漏洞。应用在处理会话 Cookie 数据时，未对内容进行安全校验，直接将其传递至系统 Shell 进行处理，攻击者可通过构造恶意会话 Cookie 注入系统命令并在服务器上执行，从而实现未授权的远程代码执行。
ICTBroadcast /login.php 命令执行漏洞（CVE-2025-2611）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-2611
https://www.vulncheck.com/blog/ictbroadcast-kev
https://thehackernews.com/2025/10/hackers-target-ictbroadcast-servers-via.html
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2611.yaml
https://attackerkb.com/topics/uwqajTHUqo/cve-2025-2611
https://www.siteguarding.com/security-blog/hackers-exploiting-ictbroadcast-cookie-flaw-cve-2025-2611-to-gain-remote-shells-what-defenders-should-know/
https://access.redhat.com/security/cve/cve-2025-2611
https://www.ictbroadcast.com/ictbroadcast-security-update-hacker-news-vulnerabilities-resolved/