CVE-2025-15500
BaseFortify
Publication date: 2026-01-09
Last updated on: 2026-01-09
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sangfor | operation_and_maintenance_management_system | to 3.0.8 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-15500 is a critical remote command execution vulnerability in Sangfor Operation and Maintenance Management System up to version 3.0.8. It occurs in the HTTP POST endpoint /isomp-protocol/protocol/getHis where the sessionPath parameter is improperly sanitized. An attacker can inject shell metacharacters into this parameter, which is then concatenated directly into a shell command and executed by the system. This allows the attacker to execute arbitrary operating system commands remotely without authentication, potentially with the privileges of the web server process (often root or tomcat). [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability can severely impact confidentiality, integrity, and availability of the affected system. An attacker can remotely execute arbitrary commands on the server, potentially gaining control over the system, accessing sensitive data, modifying or deleting information, and disrupting services. Since no authentication is required, the attack is highly accessible and can lead to full system compromise. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending a crafted HTTP POST request to the endpoint `/isomp-protocol/protocol/getHis` with a specially crafted `sessionPath` parameter that attempts to inject OS commands. For example, a proof-of-concept command is to send a POST request with payload `sessionPath=;whoami>/usr/local/tomcat/webapps/fort/trust/js/11yy.txt;&sid=1`. After sending this request, you can verify if the command executed by accessing the output file via a web browser at `/fort/trust/js/11yy.txt`. This confirms if arbitrary command execution is possible. Using tools like curl or any HTTP client, you can perform this test. Example curl command: `curl -X POST -d "sessionPath=;whoami>/usr/local/tomcat/webapps/fort/trust/js/11yy.txt;&sid=1" http://<target-ip>/isomp-protocol/protocol/getHis`. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include implementing strict input validation on the `sessionPath` parameter by whitelisting allowed characters such as alphanumeric characters, `/`, `.`, and `_`, and rejecting any shell metacharacters. Additionally, avoid direct concatenation of user input into shell commands; instead, use secure coding practices such as Java's `ProcessBuilder` with argument lists to prevent shell interpretation. Since no patches or vendor countermeasures are available, consider replacing the affected product with an alternative solution to mitigate risk. [1, 2]