wyl-cmd/cve-2025-55182针对 Next.js 原型污染漏洞 (CVE-2025-55182) 的高效批量检测工具。
Efficient batch detection tool for the Next.js prototype pollution vulnerability (CVE-2025-55182).
CVE-2025-55182 is a prototype pollution vulnerability in the Next.js framework. Attackers can exploit prototype pollution by crafting malicious requests to execute arbitrary code. This vulnerability affects applications using Next.js Server Actions.
/, /apps, /signin# Clone the repository
git clone https://github.com/your-username/CVE-2025-55182.git
cd CVE-2025-55182
# Create a virtual environment
python -m venv venv
# Activate the virtual environment
# Windows:
venv\Scripts\activate
# Linux/macOS:
source venv/bin/activate
# Install dependencies
pip install requests tqdm
# Run
python CVE-2025-55182批量测试脚本.py
Directly download and run dist/CVE-2025-55182检测工具.exe.
Create a zc folder in the same directory as the program, and place JSON asset files inside.
Asset file format (one JSON object per line):
{"host":"https://example.com","link":"https://example.com","title":"Example"}
{"host":"https://test.com","link":"https://test.com","title":"Test"}
Supported asset fields:
link - Full URL (required)host - Hostnametitle - Website titleip - IP addressport - Portpython CVE-2025-55182批量测试脚本.py
Or run the packaged exe directly:
CVE-2025-55182检测工具.exe
After startup, the program will list all JSON files in the zc directory:
============================================================
🔍 CVE-2025-55182 Vulnerability Batch Detection Tool
============================================================
============================================================
📁 Available Asset Files:
============================================================
[1] asset1.json (128.5 KB)
[2] asset2.json (256.3 KB)
============================================================
Please select the asset file number (enter q to quit): 1
Current default thread count: 10
Please enter the thread count (press Enter for default): 20
✅ Thread count set to: 20
Detection progress: 100%|████████████████████████| 1000/1000 [05:30<00:00, 3.03/s] Vuln=5
✅ Detection complete! Total time: 330.5 seconds
📊 Total scanned: 1000 | Vulnerabilities found: 5
📄 Vulnerability results exported to: D:\work\vuln.txt
Detection results are saved in the vuln.txt file in the same directory as the program, one vulnerable URL per line:
https://vulnerable-site1.com/
https://vulnerable-site2.com/apps
https://vulnerable-site3.com/signin
The following parameters can be modified in the script:
| Parameter | Default | Description |
|---|---|---|
DEFAULT_THREADS | 10 | Default number of threads |
ENUM_PATHS | ["/", "/apps", "/signin"] | List of paths to scan |
VULN_FILE_PATH | vuln.txt | Output file for vulnerability results |
This tool is intended for security research and authorized testing only. Unauthorized testing using this tool is illegal. Users must assume all legal responsibilities. The author is not responsible for any misuse.
MIT License