CVE-2022-23935 PoC — exiftool 操作系统命令注入漏洞

介绍

# CVE-2022-23935
The Exiftool software program, in versions prior to 12.38, has a security vulnerability that can be exploited through a specially crafted filename. 

This vulnerability allows for command injection, where an attacker can execute arbitrary commands on the system by appending a pipe character '|' to the end of the filename, causing the file to be treated as a command to be executed rather than as a regular file. 

As a result, any file on the system that has this naming convention can be potentially used to execute malicious code.

文件快照

备注