CVE-2025-60595 PoC — SPH Engineering UgCS 安全漏洞

Source

https://github.com/Clicksafeae/CVE-2025-60595

Associated Vulnerability

Title: SPH Engineering UgCS 安全漏洞 (CVE-2025-60595)
Description:SPH Engineering UgCS 5.13.0 is vulnerable to Arbitary code execution.

Description

SPH Engineering UgCS 5.13.0 is vulnerable to Arbitary code execution. This is the public refrence to be used on CVE site

Readme

# CVE-2025-60595
SPH Engineering UgCS 5.13.0 is vulnerable to Arbitary code execution. This is the public refrence to be used on CVE site

Arbitary code execution on the product owned by SPH Engineering. UGCS 5.13.0!
Ardupilot/mavparse.py direct lines being Lines 230  "243: on the sph engineering github we can see the parser reads XML attributes and sets value = eval(attrs['value']) If an attacker can craft an XML file with a malicious value attribute for example > __import__('os').system('touch /tmp/pwned')), eval will then execute it.

Impact: Code execution
Attack type: Local 

Discovered and report by clicksafe 
Clicksafe.pro

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →