CVE-2025-55886 PoC — ARD GEC en Ligne 安全漏洞

Source

https://github.com/0xZeroSec/CVE-2025-55886

Associated Vulnerability

Title: ARD GEC en Ligne 安全漏洞 (CVE-2025-55886)
Description:An Insecure Direct Object Reference (IDOR) vulnerability was discovered in ARD. The flaw exists in the `fe_uid` parameter of the payment history API endpoint. An authenticated attacker can manipulate this parameter to access the payment history of other users without authorization.

Readme

# CVE-2025-55886
### Description
An Insecure Direct Object Reference (IDOR) vulnerability was discovered
in ARD. The flaw exists in the `fe_uid` parameter of the payment
history API endpoint. An authenticated attacker can manipulate this
parameter to access the payment history of other users without
authorization.

### Affected Component
```
https://services.ard.fr/?eID=tx_afereload_records&_dc=1743696277812&fe_uid={USERID]&startTimestamp=1741017877&endTimestamp=1743782677&mobile=1&page=1&start=0&limit=100
```

### Affected Product Code Base
ARD GEC en Ligne - Not versioned - **Patched on 2025-04-23**

### Reseachers
- [raphckrman](https://github.com/raphckrman)
- [tryon-dev](https://github.com/tryon-dev)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →