mirror of
https://github.com/gobysec/GobyVuls.git
synced 2026-10-24 17:04:30 +00:00
12 lines
1.1 KiB
Markdown
12 lines
1.1 KiB
Markdown
|
## AstrBot /api/plugin/install-upload Command Execution Vulnerability (CVE-2025-55449)
|
|||
|
|
| **Vulnerability** | AstrBot /api/plugin/install-upload Command Execution Vulnerability (CVE-2025-55449)|
|
|||
|
|
| :----: | :-----|
|
|||
|
|
| **Chinese name** |AstrBot /api/plugin/install-upload 命令执行漏洞（CVE-2025-55449） |
|
|||
|
|
| **CVSS core** | 9.0 |
|
|||
|
|
| **FOFA Query** (click to view the results directly)| [(title="仪表盘" && body="AstrBot")]
|
|||
|
|
| **Number of assets affected** | 1100+ |
|
|||
|
|
| **Description** |FAstrBot is a common dashboard management tool widely used in enterprise environments. This vulnerability exists in the /api/plugin/install-upload interface of AstrBot. Attackers can exploit this vulnerability by sending specially crafted requests to execute arbitrary commands, potentially leading to full control of the server. |
|
|||
|
|
| **Impact** | This vulnerability allows attackers to execute arbitrary commands on the affected server, potentially leading to full server control, sensitive data leakage, and service disruption with severe consequences.|
|
|||
|
|
| **Affected versions** |< 3.5.18|
|
|||
|
|
|
|||
|
|
|