cve/2022/CVE-2022-25765.md

### [CVE-2022-25765](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25765)
![](https://img.shields.io/static/v1?label=Product&message=pdfkit&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%200.0.0%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Command%20Injection&color=brighgreen)

### Description

The package pdfkit from 0.0.0 are vulnerable to Command Injection where the URL is not properly sanitized.

### POC

#### Reference
- http://packetstormsecurity.com/files/171746/pdfkit-0.8.7.2-Command-Injection.html
- https://security.snyk.io/vuln/SNYK-RUBY-PDFKIT-2869795

#### Github
- https://github.com/ARPSyndicate/cvemon
- https://github.com/Anogota/Precious-
- https://github.com/Atsukoro1/PDFKitExploit
- https://github.com/CyberArchitect1/CVE-2022-25765-pdfkit-Exploit-Reverse-Shell
- https://github.com/GrandNabil/testpdfkit
- https://github.com/LordRNA/CVE-2022-25765
- https://github.com/PurpleWaveIO/CVE-2022-25765-pdfkit-Exploit-Reverse-Shell
- https://github.com/UNICORDev/exploit-CVE-2022-25765
- https://github.com/Wai-Yan-Kyaw/PDFKitExploit
- https://github.com/bmshema/CVE_PoCs
- https://github.com/k0mi-tg/CVE-POC
- https://github.com/lekosbelas/PDFkit-CMD-Injection
- https://github.com/lowercasenumbers/CVE-2022-25765
- https://github.com/manas3c/CVE-POC
- https://github.com/nikn0laty/PDFkit-CMD-Injection-CVE-2022-25765
- https://github.com/nomi-sec/PoC-in-GitHub
- https://github.com/shamo0/PDFkit-CMD-Injection
- https://github.com/tanjiti/sec_profile
- https://github.com/visionthex/Precious
- https://github.com/whoforget/CVE-POC
- https://github.com/x00tex/hackTheBox
- https://github.com/youwizard/CVE-POC