CVE-2025-69985

> 文章来源: Exploit-DB

> 抓取时间: 202605050452

> 原文 ID: article_740

> 生成时间: 2026-05-05 14:17

基础信息

字段值 CVECVE-2025-69985 CVSS 估计9.0+ 漏洞类型command_injection, auth_bypass 受影响组件FUXA 1.2.8

漏洞摘要

[webapps] FUXA 1.2.8 - Authentication Bypass + RCE Exploit

根因分析

command_injection, auth_bypass

攻击向量

详见原文

PoC / 关键代码

# Date: 2026-02-25
# Exploit Author: Joshua van der Poll (https://github.com/joshuavanderpoll/)
# Software Link: https://github.com/frangoteam/FUXA/tree/v1.2.8
# Vendor Homepage: https://github.com/frangoteam/FUXA
# Version: FUXA <= 1.2.8
# Tested on: Debian GNU/Linux 12
# CVE : CVE-2025-69985

"""

修复建议

vulnerability (fixed in FUXA > 1.2.8). Do not use against

Semgrep 检测 Hint

- id: auto-hint-cve_2025_69985
  pattern: 'os.system($CMD)'
  message: "Potential command_injection - 参考 CVE-2025-69985"
  severity: WARNING
  languages: [python]

标签

command_injection, auth_bypass

*由 vuln_card_gen.py 自动生成，来源: Exploit-DB*

🤖 漏洞情报系统自动分析生成 · 2026-07-02