j0ey17/cve-2025-46047PoC for Silverpeas <= 6.4.2 Username Enumeration
Proof-of-Concept script for demonstrating a username enumeration vulnerability in Silverpeas versions 6.4.1 and 6.4.2.
Summary: The vulnerability exists in the forgot password functionality (/silverpeas/CredentialsServlet/ForgotPassword endpoint). By sending POST requests with potential usernames in the Login parameter, the server responds with different HTTP status codes (200 OK for valid users, 302 Found for invalid users). This discrepancy allows a remote, unauthenticated attacker to determine valid usernames on the system.
silverpeas_enum_poc.pyrequests library (pip install requests)Clone the repository or download the script (silverpeas_enum_poc.py).
Install dependencies: pip install requests
Run the script from your terminal:
Test a single username:
python silverpeas_enum_poc.py <TARGET_URL> -u <USERNAME>
Example: python silverpeas_enum_poc.py http://vulnerable-silverpeas.local -u admin
Test usernames from a file:
python silverpeas_enum_poc.py <TARGET_URL> -w <WORDLIST_FILE>
Example: python silverpeas_enum_poc.py https://vulnerable-silverpeas.com -w users.txt
The script will output:
[+] Username '...' appears VALID (Status: 200) for usernames likely corresponding to existing accounts.[-] Username '...' appears INVALID (Status: 302) for usernames likely not corresponding to existing accounts.This script is provided for educational purposes and for demonstrating the vulnerability. Use this script responsibly and only against systems you have explicit, written authorization to test. Unauthorized scanning or testing is illegal and unethical. The author assumes no liability and is not responsible for any misuse or damage caused by this script.