CVE-2025-2611 PoC — ICT Innovations ICTBroadcast 安全漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2611.yaml

Associated Vulnerability

Title:ICT Innovations ICTBroadcast 安全漏洞 (CVE-2025-2611)
Description:ICT Innovations ICTBroadcast是巴基斯坦ICT Innovations公司的一个基于Web的自动呼叫和通信平台。 ICTBroadcast 7.4及之前版本存在安全漏洞，该漏洞源于未正确处理会话cookie数据，可能导致远程命令执行。

Description

The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that get executed on the server. This results in unauthenticated remote code execution in the session handling. Versions 7.4 and below are known to be vulnerable.

File Snapshot


 id: CVE-2025-2611

info:
  name: ICTBroadcast - Command Injection
  author: Chocapikk
  severity: cr

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!