CVE-2022-23935 PoC — exiftool 操作系统命令注入漏洞

Source

Associated Vulnerability

Readme

# CVE-2022-23935
The Exiftool software program, in versions prior to 12.38, has a security vulnerability that can be exploited through a specially crafted filename. 

This vulnerability allows for command injection, where an attacker can execute arbitrary commands on the system by appending a pipe character '|' to the end of the filename, causing the file to be treated as a command to be executed rather than as a regular file. 

As a result, any file on the system that has this naming convention can be potentially used to execute malicious code.

File Snapshot

 [4.0K]  /data/pocs/f7a74b85554b13294ac072be1151e850202ed261
├── [1.5K]  CVE-2022-23935.py
└── [ 552]  README.md

0 directories, 2 files

Remarks