CVE-2020-25223

This repository contains a functional exploit for CVE-2020-25223, a pre-authentication remote code execution vulnerability in Sophos UTM 9. The exploit sends a reverse shell payload via a crafted HTTP POST request to the target's /var endpoint.

This PoC exploits CVE-2020-25223, a command injection vulnerability in Sophos UTM, to exfiltrate the /etc/shadow file. It sends a crafted POST request to execute arbitrary commands via the SID parameter, then retrieves the shadow file and cleans up.

This Metasploit module exploits a command injection vulnerability in Sophos UTM's WebAdmin interface via the SID parameter, allowing remote code execution as root. The exploit leverages a Perl open function injection to execute arbitrary commands.